Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Filling out ISO 14001 templates
Answer:
In the case of policies and procedures you won´t need much effort since our templates are already written and they are fully editable, you just need to enter the specific information about your company. Although the forms are not pre-filled, so you will need to input all the information.
Also, it is important to highlight that our documentation not only deals with all the technicalities but also guides you on what to fill out with several comments.
You can click a "Download a Free Toolkit Demo" button to download a toolkit preview or you can click the preview of each document in the section "Toolkit Documents" here : https://advisera.com/14001academy/iso-14001-documentation-toolkit/ -
Lessons Learnt Program
Answer:
We do not have any detailed procedure for a Lessons Learnt Program. Your organization monitors performance, identifies improvement opportunities, develops improvement projects and after evaluating their effectiveness, intends to capture the know-how acquired.
A procedure for a Lessons Learnt Program should define how that know-how is acquired and transmitted to others in the organization. -
Flujogramas en los procedimientos
Mi respuesta:
No es necesario¡realizar flujogramas para los procedimientos. Tenga en cuenta que en esta nueva versión de la norma, ISO 9001: 2015, no es obligatorio escribir ningún procedimiento, por lo que puede optar por tener un procedimiento o no, y también cómo será el mismo. Sin embargo, la creación de flujogramas puede ayudar a una organización a explicar mejor un proceso, comunicarse e incluso a mejorar ese proceso.
Para obtener más información sobre la documentación de ISO 9001: 2015, consulte estos artículos:
- Nuevo enfoque para documentar y registrar el control en ISO 9001: 2015: https://advisera.com/9001academy/blog/2015/06/30/new-approach-to-document-and-record-control-in-iso-90012015/#
- Proceso de ISO 9001: 2015 vs procedimiento: https://advisera.com/9001academy/blog/2016/01/19/iso-90012015-process-vs-procedure-some-practical-examples/
Además, puede descargar este documento técnico: cómo crear un diagrama de flujo del proceso ISO 9001: https://info.advisera.com/9001academy/free-download/how-to-create-an-iso-9001-process-flowchart
Estos materiales pueden ayudarle con la implementación de la norma ISO 9001: 2015:
- Libro "Descubra ISO 9001: 2015 a través de ejemplos prácticos": https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
- Curso de Fundamentos ISO 9001: 2015: https://advisera.com/es/formacion/curso-fundamentos-iso-9001/
- Conformio - Herramienta de cumplimiento en línea: https://advisera.com/conformio/ -
Privacy Policy vs. Privacy Notice and Data breaches
1. So the first one, should the company have both: privacy policy and privacy notice? Cause I see the differences between these two, but it is really hard to find a web were both of them are there... So I messed up...
2. next one, can I write about data breaches in my risk policy? Cause there are written all information about several breaches, so it seems to me legit to write this one as well...
Answer:
1. The Privacy Policy in the EU GDPR Documentation Toolkit is meant to be an overall Policy to describe what is a company doing to be compliant with the provisions of the EU GDPR. The Privacy Notice on the other hand is a document meant to explain to the data subjects what is a data controller doing with their data. So, as you can easily see the two documents are meant to serve different purposes. To learn more about privacy notices check out our webinar “Privacy Notices Under the EU GDPR” (https://advisera.com/eugdpracademy/webinar/privacy-notices-under-the-eu-gdpr-free-webinar-on-demand/)
2. Yes, you can. Just make sure that you can distinguish between a personal data breach and a breach that does not involve personal data. To learn more about data breaches check out our webinar “A How-to Guide for GDPR Data Breach Notifications” (https://advisera.com/eugdpracademy/webinar/a-how-to-guide-for-gdpr-data-breach-notifications-free-webinar-on-demand/). -
Manual de calidad
Respuesta:
Puede justificar la ausencia del manual de calidad ya que el manual de calidad ya no es un requisito obligatorio según ISO 9001: 2015. Sin embargo, su organización puede decidir escribir un manual de calidad si lo considera útil.
Para obtener más información sobre el manual de calidad en ISO 9001, consulte estos artículos:
- El futuro del manual de calidad en ISO 9001: 2015: https://advisera.com/9001academy/pt-br/kit-de-documentacao-da-iso-9001/nowledgebase/el-futuro-del-manual-de-calidad-en-la-iso-90012015/
- Escribir un manual breve de calidad: https://advisera.com/9001academy/pt-br/kit-de-documentacao-da-iso-9001/nowledgebase/escribir-un-breve-manual-de-calidad/
Estos materiales pueden ayudarlo a comprender mejor ISO 9001: 2015:
- Libro "Descubra ISO 9001: 2015 a través de ejemplos prácticos" (disponible en inglés): https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
- Curso de Fundamentos ISO 9001: 2015: https://advisera.com/es/formacion/curso-fundamentos-iso-9001/
- Conformio - Herramienta de cumplimiento en línea: https://advisera.com/conformio/ -
How telecom companies appoint DPO and Data Processor
1) it is mandatory to appoint a DPO
2) it is mandatory to appoint a "Data Processor"
Answer:
1) Usually telecom companies need to appoint a DPO because they are processing personal and traffic data of their customers. Moreover you may perform network surveillance as well to monitor the traffic and parameters on your network as well as to detect unusual traffic thus you would be monitoring the behavior of your customers.
2) Not sure what you mean about “appointing a Data Processor”. The EU GDPR defines the processor as “a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller; “. So processors are not appointed but rated they contracted by controller to process data on their behalf.
To learn more about the EU GDPR check out our “EU GDPR Foundations Course” (https://advisera.com/training/eu-gdpr-foundations-course//) -
Document hierarchy
Answer: Any management system will have several types of documents. The purpose of a document hierarchy is to give a sense, a positioning for each type of document. Please check Figure 1 in this blog post, “How to structure ISO 14001 documentation” (https://advisera.com/14001academy/blog/2016/11/28/how-to-structure-iso-14001-documentation/ ) The number of procedures, their scope and depth will be a function of each organization. Normally, I create a procedure for each process and If any more documented information is needed I use work instruction. The following material will provide you information about the document hierachy: - ISO 9001 – How to structure quality management system documentation - https://advisera.com/9001academy/knowledgebase/how-to-structure-quality-management-system-documentation/ - free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/ - book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Definition of a disaster
Answer:
A disaster is if the incident lasts longer than what you have set as your RTO (Recovery Time Objective). In other words, this is when an incident disrupts your activities for a time that is longer than what is acceptable for your business.
In the ISO 22301 Documentation Toolkit you can find this definition in the document "Business Continuity Plan" section "3.4 Plan activation; plan deactivation" (folder 06 in the toolkit).
Regarding scenarios, you can find most common scenarios in the document "Examples of disruptive incidents scenarios" (folder 05). -
ISO 27001 Lead Auditor vs CISA
Answer: This will depend of the type and depth of the activities you desire to perform. If your want to focus on information security management, you should consider ISO 27001 Lead Auditor. If you want to go beyond the scope of information security, and also consider the strategic relationships between information security and the information systems and business objectives you should consider CISA. Please note that these courses do not exclude each other, they only offer different perspectives about how information interacts with business.
These articles will provide you further explanation about personal certifications:
- CISA vs. ISO 27001 Lead Auditor certification https://advisera.com/training/iso-27001-lead-auditor-course/
- What does ISO 27001 Lead Auditor training look like? https://advisera.com/27001academy/blog/2016/08/29/what-does-iso-27001-lead-auditor-training-look-like/
This material will also help you regarding audit training:
- ISO 27001 Lead Auditor Course preparation training [free webinar on demand] https://advisera.com/training/iso-27001-lead-auditor-course/ -
Filling the Inventory of assets
You assistance would be appreciate. I am asking because somewhere in documentation, it was highlighted that the templates are partially filled up to 80%
Answer: As a first support, these are some examples about how to fill in this template:
- ID: 001
- Asset category: People
- Name of asset: Server administrator
- Asset owner: IT manager
- Asset description: Person responsible for the administration of organization's servers
- Impact: 4 (in a scale from 1 to 5)
- Notes: Currently there is no backup person for the server administrator
- ID: 002
- Asset category: Equipment
- Name of asset: Notebook
- Asset owner: Notebook's user
- Asset description: mobile computer
- Impact: 3 (in a scale from 1 to 5)
- Notes: Notebooks may be used outside organization's premises
The second sheet of the Excel file also has a suggested list of assets you can consult.
If you understand you still need further assistance, you can schedule a meeting with one of our consultants, so he can help you. To schedule a meeting, please access this link: https://advisera.com/27001academy/consultation/
This article will provide you further explanation about inventory of assets:
- How to handle Asset register (Asset inventory) according to ISO 27001 https://advisera.com/27001academy/knowledgebase/how-to-handle-asset-register-asset-inventory-according-to-iso-27001/