Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Subscription services
2. Consent :
We currently have 'Contact form' on our website. We need to take consent of a person to contact him / her to resolve their queries (for which they are contacting us) and send him / her periodic updates about our products and events etc. We may be sharing their data with third party marketing service provider in case they opt for receiving periodic updates. Our privacy notice talks about third parties. Is it okay to give reference of our privacy policy in the consent form ? Instead of having a long consent form can we just ask the user to refer to privacy policy for details such as data shared with third parties ?
3. Revoking the consent to send emails with periodic updates - We do not provide facility of creating user id etc on our Website. Based on data collected from contact form, we send newsletters and product updates. We have an 'Unsubscribe' option in periodic updates email that we send.s it necessary to provide 'Unsubscribe' option on website also - e.g. should we have a link -
Required documented information
Answer:
Please check clause 4.4.2, “To the extent necessary, the organization shall” and then “a) maintain documented information to support the operation of its processes”. ISO 9001:2015 has no requirement making procedures mandatory. So, according to the advice from 4.4.2 a) it is up to each organization to evaluate the value added of creating, or not, a documented procedure.
The f ollowing material will provide you information about documented procedures creation:
- ISO 9001 - List of mandatory documents required by ISO 9001:2015 https://advisera.com/9001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-90012015/
- New approach to document and record control in ISO 9001:2015 https://advisera.com/9001academy/blog/2015/06/30/new-approach-to-document-and-record-control-in-iso-90012015/
- Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
The life cycle perspective
Answer:
Your organization must make provisions for all environmental aspects during the whole lifecycle, including end of life. Identify all relevant steps after the product leave the plant or the service is provided, and for each step determine possible aspects and impacts. I always give the example of manufacturing AA batteries, imagine what a consumer can do after the battery becomes dead. That is why packaging tries to influence consumers to give a proper final disposition. A normal procedure for aspects and impacts determination can be used as long as the methodology applies to those steps after selling.
The following material will provide you information about implementing the life cycle perspective:
- ISO 14001 – Lifecycle perspective in ISO 14001:2015 – What does it mean? https://advisera.com/14001academy/blog/2017/02/20/lifecycle-perspective-in-iso-140012015-what-does-it-mean/
- How does pro duct life cycle influence environmental aspects according to ISO 14001:2015? https://advisera.com/14001academy/blog/2016/03/21/how-does-product-life-cycle-influence-environmental-aspects-according-to-iso-140012015/
- ISO 14001 documentation Toolkit https://advisera.com/14001academy/iso-14001-documentation-toolkit/
- free online training ISO 14001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/
- book - THE ISO 14001:2015 COMPANION – A A Straightforward Guide to Implementing an EMS in a Small Business - https://advisera.com/books/the-iso-14001-2015-companion/ -
Scope definition
Can you please help?
Answer: According to ISO 27001, an ISMS scope must be defined in terms of information, locations or business units to be protected, considering the organization's objectives and context. For your scenario, beside which type of information (e.g., customer data, R&D information, etc.) you should consider which locations and sectors should be part of the ISMS
These articles will provide you further explanation about defining scope:
- How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
- Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/
These materials will also help you regarding defining scope:
- Book Secure & Simple: A Small-Business Guide to I mplementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Filling the risk assessment template
Answer: If you have existing measures you believe are related to the identified risk, you have to include them in the last column, even if the risk value falls as an acceptable risk. Probably these measures are the reason for the low value of the risk and your organization must be aware of them in the risk assessment and treatment process.
By the way, included in the toolkit you have access to a video tutorial that can help you fill the risk assessment template. -
Risk mitigation and BC strategy
As I had to take the exam and I still didn´t have answer for the question I bought ISO 27001 Risk Management, hoping to find the answer. But I didn´t.
The pocket book is really fine, though having read “Becoming resilient” most of the contents of the ISO 27001 Risk Management pocket book are exactly the same. But anyway I think I learned some new things.
Answer: Risk mitigation involves the implementation of controls to reduce the impact and/or probability of a risk to happen, so by mitigating risks before implementing the strategies for BC will help reduce the required resources to implement BC strategies. Regarding ISO 27001 Risk Manag ement, it has much more precise requirements regarding the timing of the mitigation - the controls do not need to be implemented right away, but they need to be planned through the Risk Treatment Plan.
For example, by installing a lightning rod system, you can reduce the need for a secondary site as result of a lighting storm damaging a build electrical infrastructure. -
Clarification on Penetration test
Answers:
1. Control A.12.6.1 can become required as result of risk assessment if you identify, for example, that one of your software suppliers often releases security updates for a critical system your organization uses.
An example regarding legal requirements is the compliance with PCI-DSS, an standard for credit card industry, which requires periodic verification of vulnerabilities on assets handling customer's credit data.
2. Provided that you are capable to evidence that the personnel performing the tests have the competencies to do so (by means of certificates, experience records or external references), these people do not need to be part of your ISMS scope. -
GDPR and recorded calls
I am not sure about the rights of the customers (callers) and I am not sure about my rights either.
1. Can a customer (caller) ask to delete the records with his/her voice?
2. Am I eligible to ask the same from my company (if for example I would like to delete all records with my voice from the archive of the company)?
Answers:
There is the same approach regardless if the request comes from an employee or a customer.
A data controller must comply with the request where:
- the individual has objected to the processing and (other than in relation to objections to direct marketing) there are no overriding legitimate grounds to justify that processing;
- the personal data is no longer needed for the purpose for which it was collected or processed;
- the individual withdraws consent and there are no other grounds for the processing;
- the per sonal data is unlawfully processed;
- there is a legal obligation under Union or Member State law to erase the personal data; or
- personal data was processed in connection with an online service offered to a child.
However the right to erasure is not an absolute right and the controller does not need to comply if the processing is:
- necessary for rights of freedom of expression or information;
- for compliance with a legal obligation under Union or Member State law;
- in the public interest or carried out by an official authority;
- for public interest in the area of public health;
- for archiving or research; or
- for legal claims.
If you want o find more about data subject rights check out our webinar “Data Subject Rights under the EU GDPR” https://advisera.com/eugdpracademy/webinar/data-subject-rights-under-the-eu-gdpr-free-webinar-on-demand/ -
IT security questionnaire
“….as part of the risk assessment the IT Security Questionnaire is completed by third parties providing details around their information security management system and control environment.”
As a growing publicly listed firm, my IT team get a lot of new software requests from our staff. Due to the maturity of some of the Fintechs that I’m asked to review I can tell that IT security framework is not that great. Hence the need for a questionnaire.
Answer: Included in the toolkit you bough there is an Internal Audit Checklist template that you can use to evaluate IT aspects of information security management.
Sections covering the controls from Annex A, specially sections A.6.2, A.9, A.10., A.12, A.13, A.14 and A.15 can help you evaluate not only your own infrastructure but also from third parties.
This template is locate on folder 10 Procedure for Internal Audit. -
Training and awareness
I am pleased to inform you that we have successfully completed the ISO27001 Stage 2 Audit and have been recommended to be certified. Thank you for all your help J.
One of the findings from the Stage 2 Audit is to generalise further the Information Security Awareness Training for our employees. Would you by any chance be able to direct me to one of your articles/presentations on this subject?
Whilst thanking you in advance for your feedback on the matter, I look forward to hearing from you soon.
Answer: First of all, congratulations for your achievement.
For Information Security Awareness and Training, I suggest these materials:
- 8 Security Practices to Use in Your Employee Training and Awareness Program https://advisera.com/27001academy/blog/2015/03/02/8-security-practices-to-use-in-your-employee-training-and-awareness-program/
- How to perform training & awareness for ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2014/05/19/how-to-perform-training-awareness-for-iso-27001-and-iso-22 301/
- How personal certificates can help your company’s ISMS https://advisera.com/27001academy/blog/2014/10/06/how-personal-certificates-can-help-companys-isms/
- Why ISO 27001 – Awareness presentation https://info.advisera.com/27001academy/free-download/why-iso-27001-awareness-presentation