Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Required GDPR documentation
Answer:
By the looks of it you are engaged in processing activities of both your employees as well as your customers. As you are a controller in both instances there are quite an extensive set of requirements that you need to comply with to achieve compliance with the EU GDPR and avoid the hefty fines. There are several record you may need to keep as required by the EU GDPR such as the “Inventory of Processing Activities” as well as records of your customer consents and if it comes to it you need to keep records of your personal data breaches.
All of the records mentioned above as well as all additional documents that you n eed to achieve compliance can be found in our “EU GDPR Documentation Toolkit” https://advisera.com/eugdpracademy/eu-gdpr-documentation-toolkit/
You can also find out about EU GDPR compliance check our free “EU GDPR Foundations Course” https://advisera.com/training/eu-gdpr-foundations-course// -
GDPR - Encrypted e-mails
Answer:
The EU GDPR in art. 23 – “Security of processing” (https://advisera.com/eugdpracademy/gdpr/security-of-processing/) mentions encryption as a means to protect personal data. It also mentions that “appropriate technical and organisational measures “ need to be taken according to the risks involving a specific processing activity.
So, basically is up to the controllers and processors to determine which security measures they need to take. Coming back to the question whether an email should be encrypted or not you would need to think about the content of your emails. Basically emails that contain large amounts of personal data should be encrypted as well as emails containing sensitive personal data.
If you want to learn more about the security of personal data you can check out our article “ How cybersecurity solutions can help with GDPR compliance” https://advisera.com/eugdpracademy/blog/2017/11/27/how-cybersecurity-solutions-can-help-with-gdpr-compliance/ -
Auditor competence for AS9100
Answer:
The AS9100 Rev D standard, as with the ISO 9001:2015 standard, does not state what is required for auditor competence for internal audits. So, as with all processes it is up to the company to define what the competences are for the internal auditors. If you define your competency as “having taken an AS9100 Rev D Internal Audit Training Course” then having taken an ISO 9001:2015 internal audit training course will not be sufficient.
However, if you define your competencies as 1) understanding AS9100 Rev D, 2) Understanding process auditing, and 3) understanding the internal processes to be audited then you need to find a way to address each of these competencies. As process auditing is the same in ISO 9001:2015 and AS9100 Rev D then having the competence to audit is covered and all you need to fulfill is the competence to understand the AS9100 Rev D standard.
For an understan ding of what is included in AS9100 Rev D see this whitepaper: https://info.advisera.com/9100academy/free-download/clause-by-clause-explanation-of-as9100-rev-d -
Log monitoring and review
NOTE : 'Control 12.4 Logging and Monitoring' has been marked applicable in the Statement of Applicability.
Answer: By monitoring you are collecting and recording information about specific events, while review refers to a critical evaluation of the gathered results (and sometimes the set of data can show relevant information that cannot be seen from isolated events), so these are different actions, and control A.12.4.1 (Event logging Control) requires not only log recording, but also the review of the collected data.
This article will provide you further explanation about log and monitoring:
- Logging and monitoring according to ISO 27001 A.12.4 https://advisera.com/27001academy/logging-according-to-iso-27001/
These materials will also help you regarding log and mon itoring:
- ISO 27001 Annex A Controls in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Scope communication
Answer: The scope statement should be known by the personnel who:
- handles the information the ISMS is intended to protect;
- work on the locations included in the ISMS scope;
- work on the processes described in the ISMS scope
Additionally, personnel that may affect or be affected by the ISMS (e.g., customers, suppliers, regulators) should be informed about the content that are relevant to them.
These articles will provide you further explanation about ISO 27001 scope:
- What is ISO 27001 https://advisera.com/27001academy/what-is-iso-27001/
- How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
- Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/
These materials will also help you regarding ISO 27001 scope:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
ISO 27001 Gap Assessment for a Bank
Answer: ISO 27001 was designed to be used by organizations of any size and industry, so there are no specific conditions required for performing a gap assessment for a bank, and you can rely on common used techniques like interviews with key personnel, documentation review and observation of daily operations.
To help you with performing a gap analysis, I suggest you to take a look at our ISO 27001 Gap Analysis Tool at this link: https://advisera.com/27001academy/free-iso-27001-gap-analysis-tool/
Its simple question-and-answer format allows you to visualize which specific elements of an information security management system you’ve already implemented, and what you still need to do. -
PCI DSS and ISO 27001
What i am trying to do is to compare ISO 27001, PCI DSS and SWIFT Customer Security Program to see which controls overlap. Any assistance?
Answer: To compare implemented security controls and practices with ISO 27001 requirements, I suggest you to take a look at our free ISO 27001 Gap Analysis Tool at this link: https://advisera.com/27001academy/free-iso-27001-gap-analysis-tool/
This simple question-and-answer format will help you to visualize which specific elements of an ISO 27001 information security management system you’ve already implemented, and what you still need to do.
These articles will provide you further explanation about PCI DSS and ISO 27001:
- PCI-DSS vs. ISO 27001 Part 1 – Similarities and Differences https://advisera.com/27001academy/knowledgebase/pci-dss/
- PCI-DSS vs. ISO 27001 Part 2 – Implementation and Certification https://advisera.com/27001academy/knowledgebase/pci-dss -vs-iso-27001-part-2-implementation-and-certification/
These materials will also help you regarding ISO 27001 implementation:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Implementing ISO 9001 and ISO 27001
Answer: You do not need to create separated documents to comply with ISO 27001 if you already have documents that cover similar requirements for ISO 9001 (e.g., control of documents, internal audit, management review, etc.), but you have to take care to adjust them to cover ISO 27001 requirements and your need for information security, and not simply write that the ISO 9001 documents also refer to the Companies ISO 27001 (e.g., in an hypothetical situation, if your internal audit for ISO 9001 is annual, but for any reason the ISO 27001 internal audit is semi-annual, then this difference should be adjusted in your internal audit procedure).
These articles will provide you further explanation about implementing management systems:
- How to impl ement integrated management systems https://advisera.com/articles/how-to-implement-integrated-management-systems/
- Using ISO 9001 for implementing ISO 27001 https://advisera.com/27001academy/blog/2010/03/08/using-iso-9001-for-implementing-iso-27001/
These materials will also help you regarding ISO 27001 implementation:
- ISO 27001 implementation: How to make it easier using ISO 9001 [free webinar on demand] https://advisera.com/27001academy/webinar/iso-27001-implementation-make-easier-using-iso-9001-free-webinar-demand/
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Documentation and scope
Answer:
1. About “how many documents” please keep in mind two phrases in ISO 9001: “keep documented information” and “maintain documented information”.
“keep documented information” means keeping records like an order from a customer, a validation checklist or a training session. Keep in mind that records can be in digital as well as in paper.
“maintain documented information” means keeping updated documents like the quality policy, or the scope of the system, or a procedure. ISO 9001:2015 does not include any requirement for mandatory p rocedures, it is up to each organization to decide what needs to maintain as a documented procedure. For example, an IT company can maintain procedures as digital checklists.
2.About the scope. For example, I work with an IT company that has three groups of customers to whom they develop software: manufacturing shoes companies; B2B commerce of fruits and vegetables and recycling companies. When developing their quality management system, they decided to just include under the certification scope the development, commercialization and service of software for the shoes manufacturing industry, because the other customers will not value working with a certified supplier.
The following material will provide you information about documented information and scope:
- ISO 9001 – List of mandatory documents required by ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-90012015/
- How to define the scope of the QMS according to ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/how-to-define-the-scope-of-the-qms-according-to-iso-90012015/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Mandatory EU GDPR documents
Answer:
Most of the documents which are marked as not mandatory are either guidance documents which are not mandated by the EU GDPR or forms that are nor mandatory and can be changed based on the requirements of your business.
Also, the whole section 8 regarding Security of Processing is marked as not mandatory because the EU GDPR requires controller and processors to have “adequate” technical and organizational measures in place to protect personal data based on the risk of processing so each organization needs to assess its own risk and decide upon the security measures.
To find out more about the mandatory documents in the EU GDPR Toolkit check out our article List of mandatory documents required by EU GDPR” https://advisera.com/articles/list-of-mandatory-documents-required-by-eu-gdpr/