Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
ISO 27001 career
Answer: Considering your interest in information security, ISO 27001 certification will be of great help to your career, because not only it presents a systematic way to implement, operate and improve an information security management system, but it is also a world-wide recognized and accepted standard, which will allow you to work in any part of the world.
2 - Which should be pursued first LI/LA as per my case? I have shortlisted onto 3 certification bodies nearer to my place here in New Delhi(India) i.e. PECB / BSI / SGS. PECB is the most expensive and SGS as the least expensive.
Answer: Let's start with the differences:
- ISO 27001 Lead Implementer – this certification recognizes people who have competency on the ISO 27001 implementation process.
- ISO 27001 Lead Auditor – this certification recognizes people who have competency on auditing an ISMS against ISO 27001 requirements and want to become certification auditor (and with this provides more confidence to an organization for being certified).
Considering your stated background, the decision about which one to take will depend on your professional purposes. If you plan to work on the implementation of information Security Management Systems, then you should consider the Lead Implementer certification. If you plan to work on certifying ISMSs, or to ensure implemented ISMSs are complaint with ISO 27001 requirements, then you should consider the Lead Auditor certification.
Regarding certification bodies, world-wide recognized LI/LA courses (also known as accredited courses), which are the first step to LI/LA certification, need to be compliant with ISO 17024 (General requirements for bodies operating certification schemes for persons), which helps ensure that even with different approaches their courses can provide confidence in the skills acquired by the people who pass their exams (PECB, BSI and SGS have accredited courses), so good criteria to select your training provider, besides cost, are the certification body reputation in your country and references from previous students (you may find these on professional social networks like LinkedIn).
These articles will provide you further explanation about ISO 27001 personnel certifications:
- What does ISO 27001 Lead Implementer training look like? https://advisera.com/27001academy/blog/2016/11/28/what-does-iso-27001-lead-implementer-training-look-like/
- What does ISO 27001 Lead Auditor training look like? https://advisera.com/27001academy/blog/2016/08/29/what-does-iso-27001-lead-auditor-training-look-like/
- Lead Auditor Course vs. Lead Implementer Course – Which one to go for? https://advisera.com/27001academy/blog/2014/06/16/lead-auditor-course-vs-lead-implementer-course-which-one-to-go-for/
This material will also help you regarding ISO 27001 personnel certifications:
- ISO 27001 Lead Auditor Course preparation training [free webinar on demand] https://advisera.com/training/iso-27001-lead-auditor-course/ -
Transition to ISO 9001:2015
Answer:
I recommend starting by performing a Gap Analysis to take a picture of the starting point. Then with that picture you can prepare a transition plan.
I recommend initiate the change by clauses 4 and 6.
The following material will provide you information about the transition:
- ISO 9001 – How to make the transition from ISO 9001:2008 revision to the 2015 revision - https://advisera.com/9001academy/blog/2015/10/06/how-to-make-the-transition-from-iso-90012008-revision-to-the-2015-revision/
- Free ISO 9001:2015 Gap Analysis Tool - https://advisera.com/9001academy/iso-9001-gap-analysis-tool/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Mandatory documents
Answer:
For the internal audit there are no specific mandatory documents besides those included in the standard and that should have been introduced with the implementation.
The following material will provide you information about mandatory documents:
- ISO 9001 – List of mandatory documents required by ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-90012015/
- Checklist of Mandatory Documentation Required by ISO 9001:2015 - https://info.advisera.com/9001academy/free-download/checklist-of-mandatory-documentation-required-by-iso-90012015
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 900 1:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Dropbox
Answer:
Unless you want to store the data locally there is not much you can do. As long as Dropbox keeps its end of the deal to keep the personal data safe you should be fine.
Don`t forget to mention in your privacy notice(s) the fact that you are using a third party to store personal data.
If you want to learn more about third party compliance check out our free “EU GDPR Foundations Course” https://advisera.com/training/eu-gdpr-foundations-course// -
Terms and conditions
2) Do we have to review our Terms and Conditions as well? Or is the privacy notice along with our Terms and conditions enough?
Answers:
For your existing users notifying them would be enough. Basically, the notice is an informative document to let know the data subjects what personal data you use when they are using your platform so if they don`t agree they can choose not to use it.
Depends what is written in the Terms and Conditions. If they refer only to what the customers are allowed to do on the platform and what their liabilities are most likely you don’t need to review them. However, if you have references to data protection matters then you should remove those and only have them separate in your Privacy Notice.
You can find more info rmation about privacy notices from our free “EU GDPR Foundations Course” https://advisera.com/training/eu-gdpr-foundations-course// -
Privacy notice template
Answer:
The template can work for website privacy notices as well. Just bear in mind that the website privacy notice may be different than other privacy notices if you collect other personal data such as IPs for example. You can have different privacy notices for different processing activities such as or your customers, website visitors, employees, etc.
You can find more information about privacy notices from our free “EU GDPR Foundations Course” https://advisera.com/training/eu-gdpr-foundations-course// -
Documented information
Answer:
Document controlling is what clause 7.5 of ISO 9001:2015 speaks about when it mentions documented information.
Clause 7.5.2 is about document creation – you want clear documents, consistent format and authorized approval and review
Clause 7.5.3.1 is about how to assure access to the documents to those that need to use them and how to protect them from loss of integrity and misuse
Clause 7.5.3.2 is about versions change control and about controlling records
The following material will provide you information about documented information:
- ISO 9001 – New approach to document and record control in ISO 9001:2015 - https://advisera.com/9001academy/blog/2015/06/30/new-approach-to-document-and-record-control-in-iso-90012015/
- Procedure for Document and Record Control - https://advisera.com/9001academy/documentation/procedure-document-record-control/
- free onl ine training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book – Discover ISO 9001:2015 Through Practical Examples – https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Internal audit requirements
Answer:
Yes, you are. Objectivity is an important issue when we speak about audits. Do not forget other issues like training about the standard and training about internal audits.
The following material will provide you information about the internal audits:
- ISO 9001 – Five Main Steps in ISO 9001 Internal Audit - https://advisera.com/9001academy/knowledgebase/five-main-steps-in-iso-9001-internal-audit/
- Free ISO 9001:2015 Internal Auditor Course - https://advisera.com/training/iso-9001-internal-auditor-course/
- free online training ISO 9001:201 5 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - ISO INTERNAL AUDIT: A PLAIN ENGLISH GUIDE - https://advisera.com/books/iso-internal-audit-plain-english-guide/ -
Risks and context
Answer:
Considering your strategic orientation your organization will determine relevant internal and external issues.
As an example of internal issues, you can have:
Quality problems;
Low productivity;
Delay problems;
New subcontractor.
As an example of external issues, you can have:
Raw materials price evolution;
New legislation that will affect what your customers, or your customers’ customers will buy;
New technology that will affect how you manufacture, or how you sell;
New consumer trends that will affect demand quality and volume.
With this kind of issues in stake, we can look at them also as uncertainty generators. And risk is the effect of uncertainty on expected results.
Quality problems, low productivity and delays can be viewed as the manifestation of risks. If your organization want to reduce the probability or frequency of those risks one good way to accomplish that is to change, to improve the processes where those risks are generated
New consumer trends are an external issue that can be viewed as a risk, or an opportunity, perhaps your organization can focus production on a particular category where demand is increasing, and you have a competitive advantage. Do you need to make changes in the production? Or in the commercial approach to the market? Do you need changes in how to buy, or whom to subcontract?
The following material will provide you information about the context and risks:
- ISO 9001 – How to address risks and opportunities in ISO 9001 - https://advisera.com/9001academy/blog/2016/06/21/how-to-address-risks-and-opportunities-in-iso-9001/
- Risk-based thinking replacing preventive action in ISO 9001:2015 – The benefits – https://advisera.com/9001academy/knowledgebase/risk-based-thinking-replacing-preventive-action-in-iso-90012015-the-benefits/
- ISO 9001:2015 Risk Management Toolkit – https://advisera.com/9001academy/iso-90012015-risk-management-toolkit/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book – Discover ISO 9001:2015 Through Practical Examples – https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
CAR, PAR, Security control
I'm understanding that in your context the P.A.R./C.A.R. is considered relevant and/or mandatory to be used, regardless of the ISO 27001 requirements.
If this is the case, then you can use the PAR to handle the implementation of the controls (it will be your Risk Treatment Plan).
The CAR can be used to handle security incidents or non conformances identified in audits, but not security threats (if the threat did not occur you should use the PAR).
Again it is important to note that CAR and PAR documents are not required by ISO 27001 and this approach works as a mean to integrate ISO 27001 practices to your working framework.