Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Documents for ISMS implementation
Answer: In this article you will see not only mandatory documents, but also the most commonly used documents for ISO 27001 implementation:
- List of mandatory documents required by ISO 27001 (2013 revision) https://advisera.com/27001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-27001-2013-revision/
These articles will provide you further explanation about ISMS implementation:
- What is ISO 27001 https://advisera.com/27001academy/what-is-iso-27001/
- ISO 27001 implementation checklist https://advisera.com/27001academy/knowledgebase/iso-27001-implementation-checklist/
These materials will also help you regarding ISMS implementation:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
New revision of ISO 14001 and its changes
2. The main changes to the standard and the implications for corporates that are ISO14001:2004 certified
Answer:
1. All ISO standards are reviewed every five years in order to keep it current and relevant for the marketplace. ISO 14001:2015 was designed to respond to latest trends and ensure it is compatible with other management system standards.
2. These are the main changes to the standard:
Increased prominence of environmental management within the organization's strategic planning processes
Greater focus on leadership
Addition of proactive initiatives to protect the environment from harm and degradation, such as sustainable resource use and climate change mitigation
Improving environmental performance added
Lifecycle thinking when considering environmental aspects
Addition of a communications strategy
In this infographic you can find more information about the main changes in ISO 14001:2015: https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/infographic-iso-140012015-vs-2004-revision-what-has-changed/
These materials can help you with the new version of the standard:
- Book - The ISO 14001:2015 companion: https://advisera.com/books/the-iso-14001-2015-companion/
- ISO 14001:2015 Foundations Course: https://advisera.com/training/iso-14001-internal-auditor-course/ -
Objetivos estratégicos vs. Objetivos de calidad
Respuesta:
Los objetivos de calidad están orientados a establecer las pautas y acciones para gestionar la organización en relación con la calidad, mientras que los objetivos estratégicos están orientados a gestionar la organización en general.
Aunque la calidad y los objetivos estratégicos no son los mismos, deben estar alineados. Puede decidir en su empresa que la calidad es un factor estratégico, por lo tanto, los objetivos de calidad serán parte de su plan estratégico.
Un ejemplo de un objetivo de calidad puede ser aumentar la satisfacción del cliente al 5%, y un ejemplo de un objetivo estratégico puede ser aumentar el 3% de las ventas.
Para obtener más información sobre los objetivos de calidad, consulte estos artículos:
- Cómo escribir buenos objetivos de calidad: https://advisera.com/9001academy/pt-br/kit-de-documentacao-da-iso-9001/nowledgebase/como-escribir-buenos-objetivos-de-calidad/
- Lo que ha cambiado con los objetivos de calidad en ISO 9001: 2015: https://advisera.com/9001academy/blog/2018/05/08/what-has-changed-with-quality-objectives-in-iso-90012015/ -
Sending marketing emails
Answer:
If you send the newsletters to existing of former customers, you provide a means for the user to unsubscribe and the content of the newsletter refers to similar services of products they purchased from you the answer would be yes. -
Cross Border Data Transfers
Answer:
If the data of your employees are being processed outside the EEA then you need to have specific safeguards in place such as Standard Contractual Clauses. Ideally you would have one singed with all suppliers processing your personal data outside the EEA. However, when dealing with SaaS suppliers they usually tend to have documents that would cover all range of customers. For starters, you could ask them to inform you about the safeguards that they are using when sending data outside the EEA.
If you want to find out more about cross border data transfers check out our webinar “How to make personal data transfers to other countries compliant with GDPR” (https://advisera.com/webinars/how-to-make-personal-data-transfers-compliant-with-gdpr-free-webinar-on-demand/). -
Sub processor data processing agreements
Thanks Andrei -
CISO role
Answer: ISO 27001 does not require the CISO position, so you can designate any existing position in your organization to assume related information security responsibilities.
Regarding the use of name and surname, we recommend the use of role or job title, because if the person responsible for information security changes, you will have to change all related documentation to the new name, while by using the job title, in general you will have to change only the organizational chart. It is important to note that this recommendation is also valid to other roles you may define in your Information Security Management System.
These articles will provide you further explanation about CISO role:
- What is the job of Chief Information Security Officer (CISO) in ISO 27001? https://advisera.com/27001academy/knowledgebase/what-is-the-job-of-chief-information-security-officer-ciso-in-iso-27001/
- Chief Information Security Officer (CISO) – where does he belong in an org chart? https://advisera.com/27001academy/blog/2012/09/11/chief-information-security-officer-ciso-where-does-he-belong-in-an-org-chart/ -
Categorizing information
Answer: Usually, information categorization is done based on the results of the risk assessment: the higher the value of information (the higher the consequence of breaching the confidentiality), the higher the classification level should be. As for the number of levels, ISO 27001 does not prescribe the levels of classification – this is something you should develop on your own, based on what is common in your country or in your industry. The most common arrangements consider 3 or 5 levels.
This article will provide you further explanation about information classification:
- Information classification according to ISO 27001 https://advisera.com/27001academy/blog/2014/05/12/information-classification-according-to-iso-27001/
These materials will also help you regarding information classification:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Responsibility for organizational knowledge
Answer:
Organizational knowledge is about several different topics.
I like to think about organizational knowledge as:
1) what the organization knows it knows
2) what the organization does not know that it knows
This can be handled by human resources and is about training, coaching by experienced workers, and experience.
3) what the organization knows it does not know
This can be handled with the help of external training, suppliers, books and technical magazines, for example and can be performed by several internal functions.
4) what the organization does not know that it does not know
This can be handled by different internal functions that maintain a kind of radar surveying relevant potential new knowledge with the help of books, magazines, blogs, conferences, networking, suppliers, …
So, I do not see this as a job for one particular function centralizing everything.
The following material will provide you information about organizational knowledge:
- ISO 9001 – How to manage knowledge of the organization according to ISO 9001 https://advisera.com/9001academy/blog/2016/08/30/how-to-manage-knowledge-of-the-organization-according-to-the-iso9001/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Use of certification logo with products
We are a online shop and want to use certificates to increase our trust level.
Therefore, I want to know, if it is allowed to use regular ISO signs you can find when you google for and just place the certificates as PDF's behind the?”
Answer:
ISO 9001 certification is not about the products but about the quality management system. According to most of the rules about the use of certification logos, they should not be used in contact with products. Nevertheless, I see, for example, buses with certification logos applied.
I would be comfortable with the use of the certification logo with the name of the manufacturer, side by side with the product.