Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Internal audit findings
Answer:
ISO 20000 contains many required records ,documents or other information. So, it's hard to generalize. In e.g. Incident Management or Change Management processes - you will look for tickets related to incidents i.e. changes. Same for Problem Management. Availability or Capacity Management will require measurements - so you'll look for measurement files.
Further on, Configuration Management requires CMDB. So, you need to check whether it exists, in which form, does it fulfill standard's requirements...etc. CIs need to have recorded incidents and changes...so, these are all items you need to check.
Also, see these articles to learn more:
"ISO 20000 internal audit – What is it and why is it important?" https://advisera.com/20000academy/blog/2016/06/07/iso-20000-internal-audit-what-is-it-and-why-is-it-important/
"What is the purpose of the internal audit report in ISO 20000?" https://advisera.com/20000academy/blog/2017/03/07/what-is-the-purpose-of-the-internal-audit-report-in-iso-20000/ -
Cláusula 7.4 de la ISO 22301
Pregunta: He estado trabajado con la documentación que me enviaron, sobre todo con la del BIA, pero ahora necesito abordar el tema de la comunicación cláusula 7.4 de la norma, tienen documentos para este punto, no lo he podido identificar en el pack de documentos. Respuesta: Puedes cubrir todas las cuestiones relativas a las comunicaciones con el Plan de Respuesta a Incidentes, el Plan de Continuidad de Negocio, y el Plan de Recuperación. Por tanto, básicamente no tenemos un documento específico para la cláusula 7.4 de la ISO 22031, pero puedes usar los documentos que he mencionado para cubrir con los requerimientos de esta cláusula. -
Implementation of knowledge management?
Answer:
You should determine the knowledge that your organization needs to operate their processes and make products and services according to requirements.
You should maintain this knowledge and make it available as needed, for example, when new people are contracted.
Consider your current knowledge when making changes, and determine how you will gain additional or updated knowledge if necessary for the changing needs.
The following material will provide you information about knowledge management:
ISO 9001 – How to manage knowledge of the organization according to ISO 9001 - - https://advisera.com/9001academy/blog/2016/08/30/how-to-manage-knowledge-of-the-organization-according-to-the-iso9001/
free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Implementation of risk management
Answer:
There are no mandatory documents required by ISO 9001:2015 to evidence implementation of Risk Management.
So, you are free to decide how to perform and evidence Risk Management. Normally, organizations create a non-mandatory procedure for addressing risks and opportunities, and generate a Risk Registry to keep a list of updated determined risks and opportunities, their evaluation according to action need; the actions performed and the evaluation of their effectiveness.
The following material will provide you information about the risk-based approach:
ISO 9001 – How to address risks and opportunities in ISO 9001 - https://advisera.com/9001academy/blog/2016/06/21/how-to-address-risks-and-opportunities-in-iso-9001/
Risk-based thinking replacing preventive action in ISO 9001:2015 – The benefits - https://advisera.com/9001academy/knowledgebase/risk-based-thinking-replacing-preventive-action-in-iso-90012015-the-benefits/
List of mandatory docum ents required by ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-90012015/
ISO 9001:2015 Risk Management Toolkit - https://advisera.com/9001academy/iso-90012015-risk-management-toolkit/
free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Management system scope change
Answer:
Will the acquired company be merged with your organization with the same brand(s) and logo? If yes, your organization is changing the scope of the management system with a new geography/site. In that case your company should contact the Certification Body to inform them about the change.
The following material will provide you information about the management scope:
ISO 9001 – How to define the scope of the QMS according to ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/how-to-define-the-scope-of-the-qms-according-to-iso-90012015/
free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
How do I get consultancy work?
Thanks. All very good advice and I will follow it up. -
EU GDPR for the banking sector
Answer:
There are no specific DSGVO (EU GDPR) for the banking sector alone, the GDPR is meant to be applicable across industries as long as personal data is being processes. The same is applicable for software development.
Generally when you are developing a software banking solution this solution would have to be compliant with the “privacy by design” and “privacy by default” principles as provided by article 25 of the EU GDPR (https://advisera.com/eugdpracademy/gdpr/data-protection-by-design-and-by-default/).
In terms of security measures article 32 of the EU GDPR provides some some security measures you should be considering (https://advisera.com/eugdpracademy/gdpr/security-of-processing/) but there are high level measures so companies are free to take whatever security measures they see fit. Y ou can always use ISO 27001 as a good starting point for your security requirements. For more insight on ISO27001 and EU GDPR you can check our article “ How does 27001 implementation satisfy EU GDPR requirements at: https://advisera.com/27001academy/blog/2016/10/17/does-iso-27001-implementation-satisfy-eu-gdpr-requirements/
Another thing you should consider, if your software is front facing the data subjects, it is the notices you would have to present to the data subjects. Guidance on the notices can be found in folder 2 “Personal data policy framework” in our EU GDPR toolkit https://advisera.com/eugdpracademy/eu-gdpr-documentation-toolkit/
Don`t forget also local banking sector specific requirements that might be applicable for banking software especially in terms of security. -
Risk assessment and BIA
A risk assessment was done for our company recently. The follow through from here is un-clear.
Also, how to calculate the Risk rating for the critical services?
Answer: The information from risk assessment can be used to prioritize which activities to focus first in your BIA, by indicating which business processes are under greater risk, saving time and effort to perform the initial BIA.
For rating critical services considering the results of a risk assessment you can consider the value of the risks, or the number of risks, associated to a specific service. For example, you can have a service with two high risks associated to it and other with ten medium risks associated to it. Considering your context, in terms of risks maybe the second service is more critical.
This article will provide you further explanation about risk assessment and BIA:
- Risk assessment vs. business impact analysis https://advisera.com/27001academy/knowledgebase/risk-assessment-vs-business-impact-analysis/ -
BCP and DRP tests
https://www.theverge.com/users/custom_write