Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Maximum Allowable Outage and non financial impact
Answer: You can have situations where the non financial impact is high and the financial impact is low, so the non financial impact is more significant to determine the MAO. In such cases the MAO is not calculated, but determined considering the perceptions of the interested parties about how much time the outage should last so the organization wouldn't be able to resume business activities. Since this is a subjective approach, you should involve personnel with as much as experience and knowledge about the impact as possible, to ensure some degree of confidence in the MAO value.
This material will also help you regarding Maximum Allowable Outage and non financial impact:
- How to implement business impact analysis (BIA) according to ISO 22301 https://advisera.com/27001academy/knowledgebase/how-to-implement-business-impact-analysis-bia-according-to-iso-22301/
- Book Becoming Resilient: The Definitiv e Guide to ISO 22301 Implementation https://advisera.com/books/becoming-resilient-the-definitive-guide-to-iso-22301-implementation/ -
ISMS implementation
Answer: First of all I suggest you ISO 27001, the ISO standard with requirements for implementing an ISMS, which will provide you a structured framework for the implementation. To have an overview of the process of implementing an ISMS according ISO 27001, I suggest you the following material:
- What is ISO 27001 https://advisera.com/27001academy/what-is-iso-27001/
- ISO 27001: An overview of the ISMS implementation process [free webinar on demand] https://advisera.com/27001academy/webinar/iso-27001-overview-isms-implementation-process-free-webinar-demand/
- Seven key problems to avoid in ISO 27001 implementat ion [free webinar on demand] https://advisera.com/27001academy/webinar/seven-key-problems-to-avoid-in-iso-27001-implementation-free-webinar-on-demand/
- ISO 27001 implementation checklist https://advisera.com/27001academy/knowledgebase/iso-27001-implementation-checklist/
- Case study: ISO 27001 implementation in an IT system integrator company https://advisera.com/27001academy/blog/2017/05/08/case-study-iso-27001-implementation-in-an-it-system-integrator-company/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
Specifically about defining the scope, I suggest this material:
- How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
- Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/
Finally, to support you implementation, I suggest you to take a look at the free demo of our ISO 27001 Documentation Toolkit at this link: https://advisera.com/27001academy/iso-27001-documentation-toolkit/
This toolkit will provide you easy to fill templates and expert support to guide you in your implementation process. -
Procedure for identification of requirements
Can you suggest some additional help material that I can use when I am working through this template. For the Information Security Scope and Policy templates, I found using the video’s very helpful, but I don’t think that there is a video related to this template.
Answer: To help you with the identification of requirements I suggest you the following material:
- How to identify interested parties according to ISO 27001 and ISO 22301 https://advisera.com/27001academy/knowledgebase/how-to-identify-interested-parties-according-to-iso-27001-and-iso-22301//
- How to identify ISMS requirements of interested parties in ISO 27001 https://advisera.com/27001academy/blog/2017/02/06/how-to-identify-isms-requirements-of-interested-parties-in-iso-27001/ -
Exclusion of requirements
@Anthony
Software validation may be exluded, or deeemed not applicable.
* may not :)
Hit enter too fast
-
Auditing AS9100D with transition training only
Answer: The process of auditing is to compare what is actually happening in a process against the planned arrangements. That being said, if you already know how to audit then what you need to update is your understanding of the planned arrangements, and an awareness and transition course will have given you this knowledge. In many cases this is all that would be needed to audit against AS9100 Rev D. I say in most cases because it is up to the company to determine the competence required for internal auditors, so if the company competence requirements are understanding auditing, understanding AS9100 Rev D and understanding internal company processes then it is the knowledge needed to meet these requirement that needs to be demonstrated, and the tr ansition course could be one way to do this.
For some more information on the changes see this article: https://advisera.com/9100academy/knowledgebase/as9100-rev-d-vs-rev-c-what-has-changed/ -
Process mapping?
Answer:
ISO 9001:2015 requires that your organization determines all key processes. “Determines” means that it is your organization that defines and establishes what is a key process, considering the scope of your QMS. ISO 9001:2015 do not use the word map, and do not require any particular visual approach to characterize each process. For example, you can use a table, each process in a row, and each item of clause 4.4.1 of ISO 9001:2015 in columns.
The following material will provide you information about the process approach:
- ISO 9001 – ISO 9001: The importance of the process approach - https://advisera.com/9001academy/blog/2015/12/01/iso-9001-the-importance-of-the-process-approach/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-14001-internal-auditor-course/"
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
3rd Party Integrator Question
My question is, do we need to have any integration partner (once again not hired by us) complete a variation of the form, 11-A.13.2 Annex 2-Standard Contractual Clauses for the Transfer of Personal Data to Processors?
Answer:
In the situation described by you it seems that you are sharing the information to those vendors because you are instructed by the controllers to do so.
If this is the case the Controllers should be the ones that requires the vendors you share the information with to sign a Data Processing Agreement. -
Representative srvices
Answer:
If you act as a controller or a processor and you are not established in the EU the EU GDPR will be applicable to you under the following conditions (https://advisera.com/eugdpracademy/gdpr/territorial-scope/) :
- You are offering goods or services to individuals in the EU (even free of charge);
- You are monitoring the behavior of individuals in the EU ;
Where these extra-territorial provisions apply, the controller or processor must appoint a representative. That representative must be based in a Member State.
This is an onerous role to take on, the EU representative will have to face off to the relevant supervisory authorities and accept liability for breach of the EU GDPR which could be substantial. So I am not sure why anyone would want to act as a representative.
So the bottom line is that Advisera does not provide this kind of representative services. -
Acuerdos con proveedores
Respuesta: Vo y en la misma línea que el proveedor de Transmisión Digital, porque supongo que ellos están considerando vuestro proveedor ERP como un proveedor que procesa, o almacena, su información, y desde mi punto de vista, no es necesario tener una relación comercial para intermcabiar información entre 2 partes (por ejemplo, puedo enviarte un email con información confidencial, antes de comenzar una relación comercial, pero antes, te solicitaré que firmes un acuerdo de confidencialidad).
Por otra parte, el Anexo A de la ISO 27001 tiene el control A.15.1.2, que dice : “All relevant information security requirements shall be established and agreed with each supplier that may access, process, store, communicate, or provide IT infrastructure components for, the organization’s information”. Por tanto, está claro -desde el punto de vista de la ISO 27001- si el proveedor de ERP procesa, o almacena información, es un proveedor que debería firmar un acuerdo con la compañía que tiene implementada/certificada la ISO 27001.
Por último, este artículo sobre el manejo de la seguridad en las relaciones con proveedores te puede interesar “6-step process for handling supplier security according to ISO 27001” : https://advisera.com/27001academy/blog/2014/06/30/6-step-process-for-handling-supplier-security-according-to-iso-27001/ -
Análisis de riesgos y acciones preventivas
He recibido esta pregunta: Tengo una duda de como aplicarían las acciones preventivas los fabricantes en la industria farmacéutica si se cambia por análisis de riesgo, Hay que hacer un análisis de riesgos a cada no conformidad.... Mi respuesta En la nueva versión de la norma en vez de un único proceso de acciones preventivas unidireccional, el cual generalmente se llevaba a cabo a un nivel bajo de la organización y permanece allí, ahora existe un proceso de enfoque basado en riesgos presidido por el equipo que tiene toda la información disponible del negocio, que es la alta dirección. En ISO 9001:2015 la alta dirección de la organización está involucrada en el proceso de identificación, registro, eliminación, y mitigación del riesgo. En enfoque basado en riesgos por lo tanto puede considerarse un proceso más eficaz que las acciones preventivas de la antigua versión de la norma. Para más información, vea el siguiente artículo: "El enfoque basado en riesgos reemplazando las acciones preventivas en la ISO 9001:2015: los beneficios" https://advisera.com/9001academy/pt-br/kit-de-documentacao-da-iso-9001/ nowledgebase/el-enfoque-basado-en-riesgos-reemplazando-las-acciones-preventivas-en-la-iso-90012015-los-beneficios/ En cuanto al análisis del riesgo no existen unos requisitos en la norma sobre cómo hacerlo. Puedes llevar a cabo mediante la forma más sencilla, que sería con una reunión del personal más relevante de la organización, o realizar un análisis DOFA, de debilidades, oportunidades, fortalezas y amenazas, y a partir de ahí determinar las acciones para abordar los riegos y oportunidades más relevantes. Para más información, vea el siguiente artículo (en inglés) "cómo abordar riesgos y oportunidades en ISO 9001": https://advisera.com/9001academy/blog/2016/06/21/how-to-address-risks-and-opportunities-in-iso-9001/# Estos materiales también le pueden ayudar con la implementación de ISO 9001: - Libro "Preparación para el proyecto de implementación ISO: una guía en un lenguaje sencillo": https://advisera.com/books/preparacion-para-el-proyecto-de-implementacion-iso-una-guia-en-un-lenguaje-sencillo/ - Formación gratuita en línea: Curso de fundamentos ISO 9001 https://advisera.com/es/formacion/curso-fundamentos-iso-9001/ - Conformio (herramienta gratuita en línea para ISO 9001): https://advisera.com/conformio/