Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
3402 statement and ISO 27001
Answer: I'm assuming you are referring to ISAE 3402, an assurance standard. Considering that, you must first evaluate your needs regarding compliance to legal requirements (e.g., laws, regulations and contracts). If you need to comply with multiple legal requirements, then ISO 27001 has a more comprehensive approach (it requires you to identify, evaluate and treat all requirements that can impact your organization in terms of information security, while ISAE 3402 focus on documenting that an organization has adequate internal controls, generally approached from a financial perspective).
These articles will provide you further explanation about how ISO 27001 can help comply with legal requirements:
- What is ISO 27001 https://advisera.com/27001academy/what-is-iso-27001/
- How ISO 27001 can help suppliers comply with U.S. DFARS 7012 https://advisera.com/27001academy/blog/2017/04/24/how-iso-27001-can-help-suppliers-comply-with-usa-dfars-7 012/
- How can ISO 27001 help you comply with SOX section 404 https://advisera.com/27001academy/blog/2017/11/21/how-can-iso-27001-help-you-comply-with-sox-section-404/
These materials will also help you regarding ISO 27001:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Integrated internal audit
Answer: It is perfectly possible to combine ISO 27001 and ISO 9001 internal audit processes, since both standards have a lot of requirements in common (the requirements for internal audit in both standards are practically the same).
These articles will provide you further explanation about similarities between ISO 27001 and ISO 9001:
- Using ISO 9001 for implementing ISO 27001 https://advisera.com/27001academy/blog/2010/03/08/using-iso-9001-for-implementing-iso-27001/
- How to implement integrated management systems https://advisera.com/articles/how-to-implement-integrated-management-systems/
2. Is it mandatory for the author of the security policies and procedures to have appropriate trainings? Shall he/she be an internal certified auditor?
Answer: ISO 27001 requires that people with roles in ISO 27001 must have proper competencies, which can be fulfilled by means of training, education or experience, so it is not mandator y for the author of security policies to have related trainings, if he can demonstrate by other means (e.g., experience) that he has the necessary competence to elaborate the polices. The same applies to the need for an certified internal auditor.
3. Where shall I document the applicable legislation for the company?
Answer: I suggest you to take a look at the free demo of our "List of Legal, Regulatory, Contractual and Other Requirements" template at this link: https://advisera.com/27001academy/documentation/list-of-legal-regulatory-contractual-and-other-requirements/ so you can have an idea of how documentation of applicable legislation looks like.
This article will provide you further explanation about ISO 27001 required documentation:
- List of mandatory documents required by ISO 27001 (2013 revision) https://advisera.com/27001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-27001-2013-revision/ -
Support contracts - are they required for ISO 27001?
Answer: ISO 27001 says that you have to assess how important that support is for the security of your data - if you conclude that this support really is important, then you should renew the contracts to be compliant with ISO 27001. This is done through the process of risk assessment.
These articles will help you:
- The basic logic of ISO 27001: How does information security work? https://advisera.com/27001academy/knowledgebase/the-basic-logic-of-iso-27001-how-does-information-security-work/
6-step process for handling supplier security according to ISO 27001 https://advisera.com/27001academy/blog/2014/06/30/6-step-process-for-handling-supplier-security-according-to-iso-27001/
These materials will also help you regarding your suppliers:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your
Own https://advisera.com/books/s ecure-simple-a-small-business-guide-toimplementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course
https://advisera.com/training/iso-27001-foundations-course/ -
Develop a traceability system
Answer:
Start by the end. Imagine that you are with a finished product in the warehouse, or that you receive a complaint about a service provided. What kind of information is requested by legislation, by your customers, or by your own organization? Go backwards step by step and determine what kind of information you want to record and easily access. Stop where you want or need. For example some organizations only keep traceability after a certain operation. In the first case, with the finished product in the warehouse, with a particular lot number, perhaps you want to see:
Who and when controlled quality of the finished product
Who, when, with what machines/team/line manufactured the product
Who, when recorded process control verifications
What raw materials and subassemblies were used
Who manufactured those subassemblies
Who and when controlled raw materials used
Who and when supplied the raw materials
This is just an example.
The following material will provide you informati on about traceability:
- ISO 9001 – ISO 9001:2015 clause 8.5 Product realization – Practical examples for compliance - https://advisera.com/9001academy/blog/2015/11/03/iso-90012015-clause-8-5-product-realization-practical-examples-for-compliance/
- Record of Traceability [ISO 9001:2015] - https://advisera.com/9001academy/documentation/record-traceability/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Transition of ISO 9100 Revision C to Revision D
The main changes come in the first paragraphs of the standard which will comprise the main transition points, defining the context of the organization and understanding your interested parties and their needs. Many other requirements are largely similar with some new operational requirements added for product safety and prevention of counterfeit parts. It can be helpful to do a gap analysis as well (we have a simple one here: https://advisera.com/9100academy/as9100-gap-analysis-tool/)
For a lot more detail on the transition process see this whitepaper: https://info.advisera.com/9100academy/free-download/as9100-twelve-step-transition-process-from-rev-c-to-rev-d -
Audit team
Answer:
Yes, you can. Just make sure you have an appropriate audit documented methodology and have your auditors take some EU GDPR awareness trainings.
Also make sure that the persons performing the audit did not do the EU GDPR implementation, due to conflict of interests.
You can find useful EU GDPR Foundation course on our website here https://advisera.com/training/eu-gdpr-foundations-course// -
Toolkit support
Answer: Included with our toolkits you can send filled documents for review (the quantity of documents you can send will depend on the purchased toolkit). We'll provide our comments on how you can improve them or correct items so the documents are compliant with ISO 22301 standard.
Specifically for your needs, these documents are included in the toolkit and will help you with exercising and testing:
- Disaster recovery plan
- Exercising and testing plan
- Exercising and testing report
Please access this link to have an overview of our toolkits documentation review features: https://advisera.com/27001academy/iso22301-documentation-toolkit/#toolkit-options
Access this link to understand the support: https://advisera.com/27001academy/iso22301-documentation-toolkit/#toolkit-expert -
Assessment criteria rationale
-
ISO 20000 Lead Auditor
Answer:
ISO 20000 Lead Auditor training is what you need. Certification should be also part of the training. Look for an training (and certification) provider in your area.
ITIL knowledge i.e. ISO 20000 knowledge and experience is of great help. -
Customer feedback and organizational memory
Answer:
If your organization:
receives and handles customer complaints, one example of customer feedback, that should be kept as documented information;
asks feedback from customers about their satisfaction, that information could be obtained in a conversation but, as a good practice, should be recorded and kept as documented information at least as an input for management evaluation;
receives from customers a sort of supplier performance rating, that is also customer feedback, that should be kept as documented information at least as an input for management evaluation, or input for corrective actions;
Keeping documented information is a way of keeping the memory of the organization, people can change, personal memories can play tricks on us, having an organization’s memory is an important feature to learn.
T he following material will provide you information about Customer complaints:
- ISO 9001 – Effective complaints management in a QMS - https://advisera.com/9001academy/blog/2014/09/16/effective-complaints-management-qms/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/