Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Risk based approach
Answer:
1. For example, in a Test Lab setting or in an Inspection Certification Body I would act in the same way:
a) what are the overall results that you intended to meet with your QMS in those settings?
b) did you map the processes for each of those settings? For each process, what are the overall intended results? For each process, what is its purpose?
c) for each service provided by each setting, what are the performance objectives, the specifications?
Then, for those three kinds of expected results you can ask: what can go wrong? In what ways can those expected results not being met? Each of those ways of failure is a risk. That would be my starting point. I would improve this baseline assessment with iterations done after non-conformities and performance evaluation.
2. ISO 31000 is for doing more than what is requested by ISO 9001:2015. It gives guidance, for example, about possible types of actions concerning risk mitigation, risk avoidance and risk reduction.
Please see bellow some material with information about the risk-based approach:
- ISO 9001 – How to address risks and opportunities in ISO 9001 - https://advisera.com/9001academy/blog/2016/06/21/how-to-address-risks-and-opportunities-in-iso-9001/
- Risk-based thinking replacing preventive action in ISO 9001:2015 – The benefits - https://advisera.com/9001academy/knowledgebase/risk-based-thinking-replacing-preventive-action-in-iso-90012015-the-benefits/
- ISO 9001:2015 Risk Management Toolkit - https://advisera.com/9001academy/iso-90012015-risk-management-toolkit/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Time scale for assessments
< 1 hour
1 hour < 4 hours
4 hours < 24 hours
24 hours < 2 days
1 week
Would the results be affected drastically compared to the initial time scale assessments?
Answer: The values presented in the template for time scale can be changed to fit your organization's needs without problem. They are only examples based on our experience, and changing them won't have effects on your results considering your organizational context.
This material will provide you further explanation about continuity strategy:
- How to implement business impact analysis (BIA) according to ISO 22301 https://advisera.com/27001academy/knowledgebase/how-to-implement-business-impact-analysis-bia-according-to-iso-22301/ -
BIA questionnaire content
Answer: The items identified are only examples. You should evaluate your organizational context to identify which to include or not, as well as include other items not mentioned in the list.
This materisl will provide you further explanation about BIA questionnaire:
- Implementing Business Impact Analysis according to ISO 22301 [free webinar on demand] https://advisera.com/27001academy/webinar/implementing-business-impact-analysis-according-to-iso-22301-free-webinar-on-demand/ -
Internal audit scope
Answer: Broadly speaking, you should consider the areas responsible for ISO 27001 main requirements (e.g., document control, risk assessment, management review, corrective actions, etc.), and the areas where the applicable controls stated in SoA are implemented. If you plan a single audit, all the controls stated in SoA should be audited. If you are planning multiple audits, then you can audit part of the controls stated in SoA on each internal audit, but you have to ensure that all controls were covered by your planned audits.
This article will provide you further explanation about internal audit:
- How to prepare for an ISO 27001 internal audit https://advisera.com/27001academy/blog/2016/07/11/how-to-prepare-for-an-iso-27001-internal-audit/
These materials will also help you regarding internal audit:
- ISO Internal Audit: A Plain English Guide https://advisera.com/ books/iso-internal-audit-plain-english-guide/
- ISO 27001:2013 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/ -
Risks and context
Answer:
Considering the strategic orientation of your organization, your top management team should determine internal and external issues that could affect the intended results of your QMS.
You can document that list of internal and internal issues.
Then, considering those issues, you should determine risks and opportunities. And you can list them. For example, if you determined as an external issue the possibility of competitors with new technology disrupt your market or determined the opportunity of opening a new geographical market your government negotiated for the opening of economic borders with other countries, those will be clearly good candidates for risks and opportunities determined considering clause 4.1.
You can make explicit connections between issues and risks and opportunities or not. They can only be implicit and your top man agement team can show to auditors the connections.
The following material will provide you information about the risk-based approach:
- ISO 9001 – How to address risks and opportunities in ISO 9001 - https://advisera.com/9001academy/blog/2016/06/21/how-to-address-risks-and-opportunities-in-iso-9001/
- Risk-based thinking replacing preventive action in ISO 9001:2015 – The benefits - https://advisera.com/9001academy/knowledgebase/risk-based-thinking-replacing-preventive-action-in-iso-90012015-the-benefits/
- ISO 9001:2015 Risk Management Toolkit - https://advisera.com/9001academy/iso-90012015-risk-management-toolkit/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
GDPR principle
Answer:
The EU GDPR expressly mentions at article 25 (https://advisera.com/eugdpracademy/gdpr/data-protection-by-design-and-by-default/) the concepts of data protection by design and by default as important data protection principles and imposes specific obligations on controller.
In a nutshell, the data protection by design provision requires controllers to :
- implement appropriate technical and organizational measures (such as pseudonymisation) which are designed to implement data protection principles (such as data minimization) in an effective way; and
- integrate necessary safeguards into their processing activities in order to meet the requirements of the GDPR and protect the rights of data subjects.
Under the data protection by default provision, controllers are required to implement appropriate technical and organizational measures for ensuring, by default, that only personal data which are necessary for each specific purpose of the p rocessing are processed.
Our EU GDPR toolkit https://advisera.com/eugdpracademy/eu-gdpr-documentation-toolkit/ considered these obligations on controllers and integrated them in the relevant documents. -
Categoración de Incidentes
Respuesta: Comunmente las compañías suelen utilizar 3-4 niveles/capas, por tanto, un ejemplo de 4 capas podrías ser:
Hardware -Equipamiento -Placa base -Tarjeta de red
o
Software -Aplicación -Base de datos -Oracle
Algunas compañías utilizan más de 3-4 capas, pero mi recomendación es hacerlo sencillo, es decir, 3-4 capas.
Este artículo te puede resultar interesante : “All about Incident Classification” https://advisera.com/20000academy/knowledgebase/incident-classification/ -
EU GDPR in charities
Answer:
Charities are impacted by GDPR as any other organisation. There is no exception for charities. I would start by doing a personal data processing inventory. You can find a template for this in the Advisera EU GDPR toolkit https://advisera.com/toolkits/eu-gdpr-documentation-toolkit/ afterwards if you have more questions, you can rely on Advisera to help you. -
Risk Assessments and GDPR
Answer:
The GDPR makes it mandatory to perform risk assessments in the shape of a Data Protection Impact Assessment where it is deemed that there is a risk to rights and freedoms of the individuals, whose data is being processed. -
Documentation templates and ITIL version
Answer:
Documentation toolkit (ITIL and Premium) are based on 2011 revision of ITIL . Once V3 was introduced (2007) - complete name was ITIL V3. From 2011 revision onward - it's only ITIL.