Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Change Management - purpose and objectives
Answer:
Change Management process deals with live services and their efficiency. Therefore, success (or un-success) of process activities is seen and noticed by the customer (who pays the bill, after-all). So,there are many elements why is Change Management important, and these articles can help you:
"ITIL V3 Change Management – at the heart of Service Management" https://advisera.com/20000academy/knowledgebase/itil-v3-change-management-at-the-heart-of-service-management/
"5 benefits of ITIL Change Management implementation" https://advisera.com/20000academy/blog/2016/06/21/5-benefits-of-itil-change-management-implementation/
"How to overcome barriers while implementing the ITIL/ISO 20000 Change Management process" https://advisera.com/ 00academy/blog/2015/12/15/how-to-overcome-barriers-while-implementing-the-itiliso-20000-change-management-process/
Also, this free webinar can help you
"An overview of the ITIL Change Management Process" https://advisera.com/20000academy/webinar/an-overview-of-the-itil-change-management-process-free-webinar-on-demand/ -
Fulflling control A.18.1.1
1 - Does Contractual requirements refer to any contract or service agreement we have made with a supplier; for example telecommunications, web hosting?
Answer: Contractual requirements refer to any contract or service agreement relevant to information security, established not only between your organization and suppliers, but with customers and employees too.
This article will provide you information about what to consider as contractual requirements:
- Which security clauses to use for supplier agreements? https://advisera.com/27001academy/blog/2017/06/19/which-security-clauses-to-use-for-supplier-agreements/
- What to consider in security terms and conditions for employees according to ISO 27001 https://advisera.com/27001academy/blog/2018/05/23/what-to-consider-in-security-terms-and-conditions-for-employees-according-to-iso-27001/
2 - Should the list of re gulatory and legal requirements include those required by our clients? For example the Civil Contingencies Act needed for an emergency service or local council we would be providing a serve to.
Answer: Regulatory and legal requirements relevant to information security must consider requirements from any relevant interested party, such as customers, suppliers, regulators, governments, etc.
This article will provide you information about interested parties and their requirements:
- How to identify interested parties according to ISO 27001 and ISO 22301 https://advisera.com/27001academy/knowledgebase/how-to-identify-interested-parties-according-to-iso-27001-and-iso-22301//
- How to identify ISMS requirements of interested parties in ISO 27001 https://advisera.com/27001academy/blog/2017/02/06/how-to-identify-isms-requirements-of-interested-parties-in-iso-27001/ -
Filling scope template
We have one office at a single address. However we rent a serverspace at XXXXX, equipped with server racks where we place and maintain our own servers. Electricity, heating/cooling, connectivity etc is supplied by the owner of the facility. We do not have 24/7 access. When we encounter a problem during hours that the facility is closed, we have to wait to gain access until the facility is opened again?
In your experience, does such a facility have to be included in the scope.
Answer: If your organization performs the operation and maintenance of these server racks you must include this location in your ISMS scope. If the operation and maintenance of these server racks are outsourced, then you do not need to include this location in your ISMS scope, but it is important to notice that the rented serverspace (and the outsourced operation of servers, if applicable) must be considered in the risk assessment (the risk assessment will help you to insert applica ble security clauses into the agreement with the service provider).
This article will provide you more information about defining the scope:
- Defining the ISMS scope if the servers are in the cloud https://advisera.com/27001academy/blog/2017/05/22/defining-the-isms-scope-if-the-servers-are-in-the-cloud/ -
Consultation recommendation
Answer: Our ISO 27001 Documentation toolkit covers information security in general and it is sufficient also to provide security for cloud environments, but if you have specific requirements for cloud security (e.g., laws, regulations, and customers requirements), then we recommend our ISO 27001 & ISO 27017 & ISO 27018 Cloud Documentation Toolkit. In the links bellow you can access a free demo of both toolkits:
- ISO 27001 Documentation toolkit https://advisera.com/27001academy/iso-27001-documentation-toolkit/
- ISO 27001 & ISO 27017 & ISO 27018 Cloud Documentation Toolkit https://advisera.com/27001academy/iso-27001-iso-27017-iso-27018-cloud-documentation-toolkit/
These articles will provide you more information about ISO 27017 and ISO 27018:
- ISO 27001 vs. ISO 27017 – Information security controls for cloud services https://advisera.com/27001academy/blog/2015/11/30/iso-27001-vs-iso-27017-information-security-controls-for-cloud-services/
- ISO 27001 vs. ISO 27018 – Standard for protecting privacy in the cloud https://advisera.com/27001academy/blog/2015/11/16/iso-27001-vs-iso-27018-standard-for-protecting-privacy-in-the-cloud/ -
When is EU GDPR applicable?
2. If GDPR is incompatible with domestic law how to ?(Such as GPS some country need to tracking CAR but GDPR no need)
3. How about penalty process ? (Who checked who settled and who paid the fine. And who pay? And ็Have a lawsuit after the 25-Jun or not?)
Answers:
1. The key to understanding when EU GDPR is applicable is understanding the meaning of “in the Union.” The EU GDPR .. .will only apply to personal data regarding individuals within the Union, while the nationality or habitual residence of those individuals is irrelevant. If the processing refers to a person that is physically in Thailand then the EU GDPR is not applicable.
2. The EU GDPR can be superseded by national law in some instances. However, is only EU Member State Law that can supersede the provisions of the Regulation.
3. The GD PR only sets the maximum fines. The way the fines are applied is subject to local Member State Law.
To learn more the EU GDPR check out our free “EU GDPR Foundation Course” https://advisera.com/training/ -
What is clause 9 about?
Answer:
Clause 9 is not about monitoring and measuring of gages and calibration. Clause 9 is more about process and management system performance. Quality control is included in clauses 8.4 and 8.6. Calibration in included in clause 7.1.5.
The following material will provide you information about monitoring and measurement:
- ISO 9001 – Monitoring and Measurement: The basis for evidence-based decisions - https://advisera.com/9001academy/blog/2020/09/21/how-to-perform-monitoring-and-measurement-according-to-iso-9001/
- Analysis of measuring and monitoring requirements in ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/analysis-of-measuring-and-monitoring-requirements-in-iso-90012015/
- Practical tips for measuring your QMS according to ISO 9001:2015 clause 9.1 - https://advisera.com/9001academy/blog/2017/08/29/practical-tips-for-measuring-your-qms-according-to-iso-90012015-clause-9-1/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
“Refer a Friend” program
Yes, there is only one kind of consent. However, depending to what are you referring your friend to legitimate interest may work as well. -
DPO ROLE
Answer:
There is no DPO manual available to explain what is the DPO supposed to do under different scenarios. It does not work like this. The DPO role is a complex one and it does not come with a “user manual”.
Usually in case of a data breach the DPO would be the one in charge of the following:
- establishing the severity of the data breach;
- drafting the data breach notification to the SAs or data subjects;
- act as a contact person for the SAs and data subjects concerned;
- inform the management of the company about the data breach and its consequences for the rights and freedoms of the affected data subjects
To learn more about the DPO role check out our webinar “Role of the DPO according to EU GDPR” https://advisera.com/eugdpracademy/webinar/role-of-the-dpo-according-to-eu-gdpr-free-webinar-on-demand/ -
Becoming GDPR compliant
2. Also, I would like to know: if we weren't GDPR compliant before, does this mean we have to contact all of our databases to reacquire their consent all over again in the new GDPR way?
3. Our website asks ppl to sign up to receive emails - so we collect email and their name - if they want they can sign up via Facebook or telegram messenger too but it's primarily email and name. Do these 2 things count as 'personal information'?
4. What does 'personal information' include?and I'm so sorry but one last final question to add to the previous one: if you have an ebook or some other kind of material available on the website but we ask that you register with your email address in order to continue reading, does this still constitute 'consent given freely'?
Answers:
1. With some minor exceptions the rules regarding the EU GDPR apply to all companies regardless of their size. The most important is the exemption from keeping records of processing activities pursuant to article 30 - “Records of processing activities” (https://advisera.com/eugdpracademy/gdpr/records-of-processing-activities/). This document is mandatory if (a) the company has more than 250 employees; or (b) the processing the company carries out is likely to result in a risk to the rights and freedoms of data subjects; or (c) the processing is not occasional; or (d) the processing includes special categories of data (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation);or (e) the processing includes personal data relating to criminal convictions and offences.
2. Where consent has been given under the Data Protection Directive, it will continue to be valid under the EU GDPR if it also meets the requirements of the Regulation.
This may be difficult given the new and stringent requirements for consent. In theory, some businesses should therefore consider approaching their existing customers or employees to obtain a fresh consent that is valid under the Regulation.
3. Name and email address constitute personal data.
4. The EU GDPR define personal data as “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.
Examples of personal data include: name, surname, email address, physical address, IP address, internet identifiers, bank account data, images, etc.
To learn more about the EU GDPR check out our “EU GDPR Foundation Course” https://advisera.com/training/eu-gdpr-foundations-course// -
Is consent needed?
2. If the patients record has 3rd party data in it, for example a midwifes notes, this data is not owned by the GP, but could be relevant to the SAR, under GDPR is consent needed by the 3rd party to release the data?
Answers:
1. The consent is not needed if the third party which asks for the information acts to preserve public interest or the vital interest of the data subject. I don`t think that using the data in conferences qualifies. However, if the data is anonymized so it cannot be traced back to a patient then consent is not needed.
2. The data in the SAR need to be date which concerns the patient, if the midwifes notes are related to that patient the information must be provided.