Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11291 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Log monitoring and review
NOTE : 'Control 12.4 Logging and Monitoring' has been marked applicable in the Statement of Applicability.
Answer: By monitoring you are collecting and recording information about specific events, while review refers to a critical evaluation of the gathered results (and sometimes the set of data can show relevant information that cannot be seen from isolated events), so these are different actions, and control A.12.4.1 (Event logging Control) requires not only log recording, but also the review of the collected data.
This article will provide you further explanation about log and monitoring:
- Logging and monitoring according to ISO 27001 A.12.4 https://advisera.com/27001academy/logging-according-to-iso-27001/
These materials will also help you regarding log and mon itoring:
- ISO 27001 Annex A Controls in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Scope communication
Answer: The scope statement should be known by the personnel who:
- handles the information the ISMS is intended to protect;
- work on the locations included in the ISMS scope;
- work on the processes described in the ISMS scope
Additionally, personnel that may affect or be affected by the ISMS (e.g., customers, suppliers, regulators) should be informed about the content that are relevant to them.
These articles will provide you further explanation about ISO 27001 scope:
- What is ISO 27001 https://advisera.com/27001academy/what-is-iso-27001/
- How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
- Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/
These materials will also help you regarding ISO 27001 scope:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
ISO 27001 Gap Assessment for a Bank
Answer: ISO 27001 was designed to be used by organizations of any size and industry, so there are no specific conditions required for performing a gap assessment for a bank, and you can rely on common used techniques like interviews with key personnel, documentation review and observation of daily operations.
To help you with performing a gap analysis, I suggest you to take a look at our ISO 27001 Gap Analysis Tool at this link: https://advisera.com/27001academy/free-iso-27001-gap-analysis-tool/
Its simple question-and-answer format allows you to visualize which specific elements of an information security management system you’ve already implemented, and what you still need to do. -
PCI DSS and ISO 27001
What i am trying to do is to compare ISO 27001, PCI DSS and SWIFT Customer Security Program to see which controls overlap. Any assistance?
Answer: To compare implemented security controls and practices with ISO 27001 requirements, I suggest you to take a look at our free ISO 27001 Gap Analysis Tool at this link: https://advisera.com/27001academy/free-iso-27001-gap-analysis-tool/
This simple question-and-answer format will help you to visualize which specific elements of an ISO 27001 information security management system you’ve already implemented, and what you still need to do.
These articles will provide you further explanation about PCI DSS and ISO 27001:
- PCI-DSS vs. ISO 27001 Part 1 – Similarities and Differences https://advisera.com/27001academy/knowledgebase/pci-dss/
- PCI-DSS vs. ISO 27001 Part 2 – Implementation and Certification https://advisera.com/27001academy/knowledgebase/pci-dss -vs-iso-27001-part-2-implementation-and-certification/
These materials will also help you regarding ISO 27001 implementation:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Implementing ISO 9001 and ISO 27001
Answer: You do not need to create separated documents to comply with ISO 27001 if you already have documents that cover similar requirements for ISO 9001 (e.g., control of documents, internal audit, management review, etc.), but you have to take care to adjust them to cover ISO 27001 requirements and your need for information security, and not simply write that the ISO 9001 documents also refer to the Companies ISO 27001 (e.g., in an hypothetical situation, if your internal audit for ISO 9001 is annual, but for any reason the ISO 27001 internal audit is semi-annual, then this difference should be adjusted in your internal audit procedure).
These articles will provide you further explanation about implementing management systems:
- How to impl ement integrated management systems https://advisera.com/articles/how-to-implement-integrated-management-systems/
- Using ISO 9001 for implementing ISO 27001 https://advisera.com/27001academy/blog/2010/03/08/using-iso-9001-for-implementing-iso-27001/
These materials will also help you regarding ISO 27001 implementation:
- ISO 27001 implementation: How to make it easier using ISO 9001 [free webinar on demand] https://advisera.com/27001academy/webinar/iso-27001-implementation-make-easier-using-iso-9001-free-webinar-demand/
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Documentation and scope
Answer:
1. About “how many documents” please keep in mind two phrases in ISO 9001: “keep documented information” and “maintain documented information”.
“keep documented information” means keeping records like an order from a customer, a validation checklist or a training session. Keep in mind that records can be in digital as well as in paper.
“maintain documented information” means keeping updated documents like the quality policy, or the scope of the system, or a procedure. ISO 9001:2015 does not include any requirement for mandatory p rocedures, it is up to each organization to decide what needs to maintain as a documented procedure. For example, an IT company can maintain procedures as digital checklists.
2.About the scope. For example, I work with an IT company that has three groups of customers to whom they develop software: manufacturing shoes companies; B2B commerce of fruits and vegetables and recycling companies. When developing their quality management system, they decided to just include under the certification scope the development, commercialization and service of software for the shoes manufacturing industry, because the other customers will not value working with a certified supplier.
The following material will provide you information about documented information and scope:
- ISO 9001 – List of mandatory documents required by ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-90012015/
- How to define the scope of the QMS according to ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/how-to-define-the-scope-of-the-qms-according-to-iso-90012015/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Mandatory EU GDPR documents
Answer:
Most of the documents which are marked as not mandatory are either guidance documents which are not mandated by the EU GDPR or forms that are nor mandatory and can be changed based on the requirements of your business.
Also, the whole section 8 regarding Security of Processing is marked as not mandatory because the EU GDPR requires controller and processors to have “adequate” technical and organizational measures in place to protect personal data based on the risk of processing so each organization needs to assess its own risk and decide upon the security measures.
To find out more about the mandatory documents in the EU GDPR Toolkit check out our article List of mandatory documents required by EU GDPR” https://advisera.com/articles/list-of-mandatory-documents-required-by-eu-gdpr/ -
Main changes in documentation
Answer:
About procedures and manual, they are no longer mandatory – different from forbidden. Something that gives organizations much more freedom to adapt and use what they find useful, and when they find it useful.
The following material will provide you information about the main changes with ISO 9001:2015:
Check this free infographic - Infographic: ISO 9001:2015 vs. 2008 revision – What has changed? – https://advisera.com/9001academy/knowledgebase/infographic-iso-90012015-vs-2008-revision-what-has-changed/
Check this free Gap Analysis tool - Free ISO 9001:2015 Gap Analysis Tool - https://advisera.com/9001academy/iso-9001-gap-analysis-tool/
- Free webinar – ISO 9001:2015 vs ISO 9001:2008 – The main changes - https://advisera.com/9001academy/webinar/iso-90012015-vs-iso-90012008-the-main-changes-free-webinar-on-demand/
ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-14001-internal-auditor-course/ ourse/
- book – Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Environmental aspects at different situations
ie, normal, abnormal and emergency?”
Answer:
You want to make a fair and rather complete assessment of how your organization interacts or may interact with the environment. Please consider Annex A.6.1.2 where it states clearly that one should consider normal and abnormal operating conditions, shut-down and start-up conditions, as well as reasonably foreseeable emergency situations.
The following material will provide you information about assessment of environmental interactions:
- ISO 14001 – 4 steps in identification and evaluation of environmental aspects - https://advisera.com/14001academy/knowledgebase/4-steps-in-identification-and-evaluation-of-environmental-aspects/
- List of ISO 14001 implementation steps - https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/list-of-iso-14001-implementation-steps/
- free online training ISO 14001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/
- book - THE ISO 1 4001:2015 COMPANION – A A Straightforward Guide to Implementing an EMS in a Small Business - https://advisera.com/books/the-iso-14001-2015-companion/ -
Data transfer
Answer:
Once the EU GDPR kicks in you would need to provide a Privacy Notice to the individuals whose data you are collecting during the shows you mentioned.
Your privacy notice should contain the information required by EU GDPR art. 13 “ Information to be provided where personal data are collected from the data subject” (https://advisera.com/eugdpracademy/gdpr/information-to-be-provided-where-personal-data-are-collected-from-the-data-subject/ ) namely:
• Your identity, contact details and details of your representative (if any);
• The contact details of your data protection officer;
• The purpose and legal basis of processing. Where legitimate interests is relied upon, details of those interests;
• The right to withdraw consent (if this is the basis for any processing;
• The categories of personal data processed;
• The recipients or categories of recipients of personal data;
• Details of any intended transfer outside the Union. Details of any safeguards relied upon and the means to obtain copies of transfer agreements;
• The period for which data will be stored or the criteria used to determine this period;
• A list of the individual’s rights, including the right to object to direct marketing, make a subject access request, and to be “forgotten”;
• Details of any automated decision making, including details of the logic used and potential consequences for the individual;
• Whether provision of personal data is a statutory or contractual requirement, whether disclosure is mandatory and the consequence of not disclosing personal data;
• The right to complain to a supervisory authority;
To find out more about privacy notices check out our webinar “Privacy Notices under the EU GDPR” https://advisera.com/eugdpracademy/webinar/privacy-notices-under-the-eu-gdpr-free-webinar-on-demand/ as well as our free “EU GDPR Foundations Course” https://advisera.com/training/eu-gdpr-foundations-course//