Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
EU GDPR requirements
Answer:
Usually the main establishment will be the place of central administration. In case the place of central administration is not located in the EU, the main establishment will be the establishment in the EU where the main processing activities take place.
In your case based on your description I would suggest to setup a repres entative in Germany because you will be dealing most with German data subjects but also because the German Supervisory Authority is quite active in providing advice to controllers and processors alike. -
Cross border personal data transfer procedure
Answer:
First of all I would like to mention that cross border transfer refers to the situation where personal data is stored or accessed from outside the EEA. So in your case if the data is stored in UK but it can be accessed from the US than it is definitely a cross border data transfer. -
ISO 9001 certification
Answer:
Any organization can implement a quality management system according to ISO 9001. What results does your organization intends to meet by being certified? If your customers value being also ISO 14001 perhaps you should implement an integrated system (quality and environmental).
The following material will provide you information about the benefits of certification:
- ISO 9001 – Six Key Benefits of ISO 9001 Implementation - https://advisera.com/9001academy/knowledgebase/six-key-benefits-of-iso-9001-implementation/
- ISO 14001 - 6 Key Benefits of ISO 14001 - https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/6-key-benefits-of-iso-14001/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
ISO 27001 and EU GDPR
Answer: ISO 27001 is a standard which focus on protection of information, and EU GDPR is a regulation defining requirements for protection of privacy, so ISO 27001 can be used as basis to achieve compliance with ca 50% of EU GDPR.
These articles will provide you further explanation about ISO 27001 and EU GDPR:
- ISO 27001 implementation checklist https://a dvisera.com/27001academy/knowledgebase/iso-27001-implementation-checklist/
- 9 steps for implementing GDPR https://advisera.com/articles/9-steps-for-implementing-gdpr/
- Does ISO 27001 implementation satisfy EU GDPR requirements? https://advisera.com/27001academy/blog/2016/10/17/does-iso-27001-implementation-satisfy-eu-gdpr-requirements/
These materials will also help you regarding ISO 27001 and EU GDPR:
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/
- Free online training EU GDPR Foundations Course https://advisera.com/training/eu-gdpr-foundations-course// -
Vulnerability scanning periodicity
Answer: ISO 27001 specify only which objectives must be achieved when performing a vulnerability scanning (see control A.12.6.1 Management of technical vulnerabilities). The frequency should be defined by each organization, considering the perceived risks and the sensitiveness of the information and information systems involved.
These articles will provide you further explanation about penetration testing:
- How to use penetration testing for ISO 27001 A.12.6.1 https://advisera.com/27001academy/blog/2016/01/18/how-to-use-penetration-testing-for-iso-27001-a-12-6-1/
- How to manage technical vulnerabilities according to ISO 27001 control A.12.6.1 https://advisera.com/27001academy/blog/2015/10/12/how-to-manage-technical-vulnerabilities-according-to-iso-27001-control-a-12-6-1/
This material will also help you regarding penetration testing:
- ISO 27001 Annex A Controls in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/ -
Policy template content
Track name [List of authorized persons to access documents]
Storage location With the information itself, at the place where the degree of secrecy is indicated
Responsible person for storage Information resource owner
How to protect records In the same way that information is protected
Storage time The list must exist for the duration of the information itself
Track name – what does the track refer to?
Example: The price in the contract or the whole contract? A record in database or entire database?
Answer: The track name refers to the name by which the record is known in the organization. For example, for contracts you may use as track name the word "contract"to refer to any type of contract, the expression "customers contracts", to refer to contracts related only to customers, or the expression "service contracts" to refer to contracts related to services provided by your organization. This definition is up to each organization depending on how it refers to its information.
These materials will also help you regarding control of documents:
- Records management in ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2014/11/24/records-management-in-iso-27001-and-iso-22301/
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Root cause analysis in AS9100D
Answer:
The AS9100 Rev D standard does not specify how you identify root cause analysis, so unless you have customer requirements telling you how you will do the root cause analysis you can choose any way you wish; 5 Why, fishbone, 8D, etc.
It is also useful to note that the new revision of AS9100 now allows you to made a determination for your process nonconformities to determine if you require the full root cause analysis and corrective action to address this (See clause 10.2.1 b). You do need to correct the problem and deal with the consequences, but you can then determine if you need to take action to eliminate the cause of the nonconformity. Again, if your customer is requiring you to perform full root cause analysis on a problem you will not have a choice.
For more information on the corrective action process in AS9100 Rev D see this article: https://advisera.com/9100academy/knowledgebase/corrective-actions-vs-continual-improvement-in-as9100/ -
Supplier Data Processing Agreements
Is the reseller's duty to ensure the products its sells are compliant with the legal requirements including the EU GDPR. -
Quality Manual content
Answer:
Now, ISO 9001:2015 does not require a quality manual, so we have total liberty to develop that kind document. I like your idea or making it as short as possible, perhaps 10 pages. 10 pages where you answer to questions like:
a) Who are we?
b) What do we do?
c) Whom do we serve?
d) What kind of compromises do we assume?
e) How do we work? (where you can map your processes and explain each one in plain English. I like to use photos and charts as much as possible)
The following material will provide you information about the quality manual:
- ISO 9001 – Writing a short Quality Manual - https://advisera.com/9001academy/knowledgebase/writing-a-short-quality-manual/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Controller vs processor
Answer:
For the situation you described the insurance company acts as a controller in its own rights because they would be determining the means and purpose of the processing regarding the data of your employees.
If you want to find out more about the distinction between processors and controllers check out our article “EU GDPR controller vs. processor – What are the differences?” - https://advisera.com/eugdpracademy/knowledgebase/eu-gdpr-controller-vs-processor-what-are-the-differences/