Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Legal & Regulatory Requirements
The key term in this ISO 22301 requirement is "relevant parties" (to your business). You do not have to identify requirements for all customers. Your organization may already have criteria to identify which ones are most important to you (e.g., total sales per customer, frequency of purchase, time of relationship, etc.), and you can use these criteria to sort the clients from whom you will have to identify needs and legal requirements.
For these clients identified as relevant according your criteria, you have to go through all the agreements you have with them and see if there are requirements related to business continuity.
ISO 27001 has a similar requirement and this article will provide you explanation that also can be applicable to ISO 22301:
- How to identify ISMS requirements of interested parties in ISO 27001 https://advisera.com/27001academy/blog/2017/02/06/how-to-identify-isms-requirements-of-interested-parties-in-iso-27001/
This material will also help you regarding ISO 22301 requirements identification:
- Book Becoming Resilient: The Definitive Guide to ISO 22301 Implementation https://advisera.com/books/becoming-resilient-the-definitive-guide-to-iso-22301-implementation/ -
Emergency medical service key performance indicators
Answer:
Performance indicators are measurement tools that should be “specific, measurable, action oriented, relevant and timely”. Three types of indicators are used to measure quality in patient care: Structure, process and outcome indicators. EMS (Emergency Medical Service) system performance indicators follow the same classification.
Structural data are attributes of the setting in which care is provided. These usually refer to the characteristics
of the different components of an EMS system including facilities, equipment, staffing, knowledge base of providers,
credentialing, deployment. Since EMS systems designs are diverse as discussed above, these indicators may not be
applicable to all systems. Emergency vehicle response time standard is the most commonly used structure measure
in EMS. The goal is to respond to 90% of priority 1 calls (life threatening and highly time dependent) in less
than 9 min utes.
Another type of measures is process data. These are the components of the encounter between the pre hospital
provider and the patient. It is an evaluation of the steps of the care provided. Process measures are more sensitive to differences in quality of care. In contrast to structure and outcome measures that provide an indirect approach to quality measurement, process measures allow for a direct assessment of quality of care. One example would be collecting specific data points on the process of endotracheal intubation performed by EMS providers to monitor the success rate of this procedure.
A third type of measures is outcome data. These evaluate the change in patient’s subsequent health status in
response to a clinical intervention. Outcome research in EMS focuses on determining the effectiveness
of some of these interventions and showing the true value of an EMS system since it offers feedback on all aspects
of care. Outcome data is easy to interpret and easily understood by the different stakeholders. Internationally, out-of-hospital cardiac arrest (OHCA) survival is the most common outcome measure used to compare EMS systems. -
Consent for marketing email
-we do not request explicit consent to receive newsletters
- we send the next newsletter, duly including a note about the GDPR and a link to our new Privacy policy/ option to unsubscribe
Answer:
If the newsletters are sent to past/present customers you should be fine relying on legitimate interest and consent won't be needed. As you already mentioned, you need to present to the customers the possibility to unsubscribe as well as the new Privacy Notice/Policy.
To learn more about how the EU GDPR affects marketing check put our webinar “How GDPR Affects Marketing Practices” https://advisera.com/eugdpracademy/webinar/how-gdpr-affects-marketing-practices-free-webinar-on-demand/ -
Controls effectiveness review
Answer: First it is important to understand that ISO 27001 does not require procedures to check the effectiveness, only that activities are performed (it is not mandatory to document them, but in some cases documentation is a best practice).
Considering that, regarding technical measures, you should consider activities for penetration tests and vulnerability assessments. For organizational measures you should consider an audit activities.
These articles will provide you further explanation about penetration tests and internal audit:
- How to use penetration testing for ISO 27001 A.12.6.1 https://advisera.com/27001academy/blog/2016/01/18/how-to-use-penetration-testing-for-iso-27001-a-12-6-1/
- How to prepare for an ISO 27001 internal audit https://advisera.com/27001academy/blog/2016/07/11/how-to-prepare-for-an-iso-27001-internal-audit/
- 8 criteria to deci de which ISO 27001 policies and procedures to write https://advisera.com/27001academy/blog/2014/07/28/8-criteria-to-decide-which-iso-27001-policies-and-procedures-to-write/
These materials will also help you regarding internal audit:
- ISO Internal Audit: A Plain English Guide https://advisera.com/books/iso-internal-audit-plain-english-guide/
- ISO 27001:2013 INTERNAL AUDITOR COURSE https://advisera.com/training/iso-27001-internal-auditor-course/ -
Citizen or residents?
Answer:
Of course the EU GDPR aims at protecting the rights and freedoms of the EU citizens but not only it also protects individuals which are not citizens or residents if the processing activity takes please in the EU.
The key to understanding when EU GDPR is applicable is understanding the meaning of “in the Union.” The EU GDPR will only apply to personal data regarding individuals within the Union, while the nationality or habitual residence of those individuals is irrelevant. For example, a company based in the EU which is processing the data of Japanese individuals located in Japan will still need to comply with the EU GDPR. Consequently, the Japanese individuals will be benefiting from all rights according to the EU GDPR, even if these rights do not exist in their own nation’s laws. -
Acciones preventivas vs. acciones para abordar riesgos y oportunidades
Respuesta:
Como mencionó, en la nueva versión de la norma, ya no existen requisitos de acciones preventivas, sino que debe definir los riesgos y las oportunidades. Su organización puede decidir que esas recomendaciones y observaciones sean riesgos / oportunidades potenciales, por lo que deberá determinar el nivel de esos riesgos / oportunidades y luego planificar las acciones para abordar esos riesgos y oportunidades, que pueden incluir mitigación, aceptación, transformación en oportunidades, etc. No necesita un formato específico para planificar las acciones; por ejemplo, puede descargar una vista previa gratuita de nuestro Procedimiento para abordar riesgos y oportunidades: https://advisera.com/9001academy/es/documentation/procedimiento-para-abordar-riesgos-y-oportunidades/
Para obtener más información sobre los riesgos y las oportunidades, puede ver estos artículos:
- El enfoque basado en riesgos reemplazando las acciones preventivas en la ISO 9001:2015: los beneficios: https://advisera.com/9001academy/pt-br/kit-de-documentacao-da-iso-9001/nowledgebase/el-enfoque-basado-en-riesgos-reemplazando-las-acciones-preventivas-en-la-iso-90012015-los-beneficios/
- Cómo abordar los riesgos y oportunidades en ISO 9001: https://advisera.com/9001academy/blog/2016/06/21/how-to-address-risks-and-opportunities-in-iso-9001/
Estos materiales también pueden ayudarle con los riesgos y las oportunidades en ISO 9001: 2015:
- Libro - Descubra ISO 9001: 2015 a través de ejemplos prácticos: https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
- Curso de Fundamentos ISO 9001: 2015: https://advisera.com/es/formacion/curso-fundamentos-iso-9001/
- Conformio - Herramienta de cumplimiento en línea: https://advisera.com/conformio/ -
GDPR tips
Now my question, whether this makes sense and whether this approach could be fatal to us. Unfortunately, it is not possible for us, e.g. 100% free for 1 month only for GDPR activities. Since you certainly have experience, also in terms of the scope, I am very curious about your tips and hints.
Answer:
First I would like to start by mentioning that a DPO is not necessary to be appointed unless (a) the processing is carried out by a public authority or b ody, except for courts acting in their judicial capacity; or (b) the core activities of the legal entity consist of processing operations which, by their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or (c) the core activities of the legal entity of processing on a large scale of special categories of data pursuant to Article 9 of the EU GDPR and personal data relating to criminal convictions and offences referred to in Article 10 of the EU GDPR. If you could link the implementation of ISMS together with GDPR it won’t constitute an issue.
To learn more about ISMS and GDPR check out our articel “Does ISO 27001 implementation satisfy EU GDPR requirements?” (https://advisera.com/27001academy/blog/2016/10/17/does-iso-27001-implementation-satisfy-eu-gdpr-requirements/). -
Contracting and GDPR
2. We buy contacts data bases from Poland(EU) company for direct marketing purposes. Should we inform the addressee from these DBs about source of their contacts and is this business lawfully at all?
Answers:
1. To transfer personal data from EU to a third country certain safeguards need to be set up according to Chapter V of the EU GDPR “Transfers of personal data to third countries or international organizations” (https://advisera.com/eugdpracademy/gdpr-text/transfers-of-personal-data-to-third-countries-or-international-organisations/). One of the most used safeguards are the Standard Contr actual Clauses which were drafted by the EU Commission to regulate the transfer the data to third countries. To find out more about transfers of personal data check out webinar “How to make personal data transfers to other countries compliant with GDPR” (https://advisera.com/webinars/how-to-make-personal-data-transfers-compliant-with-gdpr-free-webinar-on-demand/).
2. When obtaining personal data from a third party you would need to provide to the data subject an adequate Privacy Notice as required by article 14 of the EU GDPR “Information to be provided where personal data have not been obtained from the data subject” (https://advisera.com/eugdpracademy/gdpr/information-to-be-provided-where-personal-data-have-not-been-obtained-from-the-data-subject/). To find out more about privacy notices check out our webinar “Privacy Notices Under the EU GDPR” (https://advisera.com/eugdpracademy/webinar/privacy-notices-under-the-eu-gdpr-free-webinar-on-demand/). -
Software tools for BIA
Answer: Only some activities related to ISO 22301 can be semi-automated (e.g., control of documents, controls measurement, etc.). Being a management system, ISO 22301 still requires some human intervention to analyse and evaluate information, including performing BIA, so for small and mid-size business we do not recommend nothing more complex than a spreadsheet to help organize information needed for BIA.
This article will provide you further explanation about automated tool:
- When to use tools for ISO 27001/ISO 22301 and when to avoid them https://advisera.com/conformio/blog/2021/06/24/toolkit-vs-conformio-which-is-more-applicable-for-my-company/ -
Audit procedure and information logging
Answer: For an audit procedure, I suggest you to take a look at the free demo of our Internal Audit Procedure at this link: https://advisera.com/27001academy/documentation/internal-audit-procedure/
If I understood correctly, you want to know what should be logged by systems to be used as evidence in an audit. "Audit logging" is not a term used by the standard and may lead to misunderstandings.
Considering you are referring to what should be logged, you should look for legal and contractual requirements you must fulfil and the results of risk assessment (unacceptable risks ca provide you information about what should be logged). For IT systems, the most common logs are related to date, time, IP address (both from origin and destination), user (both common users and administrators), action performed (e.g., login attempts, modifications on configurati ons, etc.) and results (success or failure).
These materials will also help you regarding audits:
- ISO Internal Audit: A Plain English Guide https://advisera.com/books/iso-internal-audit-plain-english-guide/
- How to make an Internal Audit checklist for ISO 27001 / ISO 22301 https://advisera.com/27001academy/knowledgebase/how-to-make-an-internal-audit-checklist-for-iso-27001-iso-22301/