Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Certifications for consultancy
Answer: most certifications required will depend on the industries your company cover (financial, communication, etc.) and your line of business (e.g., IT security consultancy, business continuity, forensics, etc.).
Considering ISO 27001, you should consider the lead auditor and the lead implementer certifications.
These articles will provide you further explanation about ISO 27001 personnel certifications:
- What does ISO 27001 Lead Implementer training look like? https://advisera.com/27001academy/blog/2016/11/28/what-does-iso-27001-lead-implementer-training-look-like/
- What does ISO 27001 Lead Auditor training look like? https://advisera.com/27001academy/blog/2016/08/29/what-does-iso-27001-lead-auditor-training-look-like/
This material will also help you regarding ISO 27001 personnel certifications:
- ISO 27001 Lead Auditor Course preparation training [free webinar on demand] https://advisera.com/training/iso-27001-lead-auditor-course/ -
Supplier Data Processing Agreement
Answer:
The document you are referring to is the Supplier Data Processing Agreement https://advisera.com/eugdpracademy/documentation/supplier-data-processing-agreement/ that can be found in in folder 7 “ Third Party Compliance” of our EU GDPR implementation toolkit https://advisera.com/eugdpracademy/eu-gdpr-documentation-toolkit/
The Data Processing Agreement should be an Annex/Appendix to the contract (or another legally binding document) based on which the Processor processes personal data on behalf of the Controller. -
Control of documents
please note that both templates fulfills ISO 27001 requirements.
Answer: ISO 27001 doesn't require that all the documents use the same format, (the use of templates is only a best practice), so you can state in our document control procedure that any new or updated policy/procedure must be used after a defined date.
This material will also help you regarding document control:
- Managing ISO Documentation: A Plain English Guide https://advisera.com/books/managing-iso-documentation-plain-english-guide/ -
Performing risk assessment
Your conclusion is correct. By understanding which policies are already implemented and which risks are identified and considered relevant you can have a snapshot of the organization's culture, as well as some perception of the cultures of the other organizations which have business with it. -
BYOD Policy template content
there are no more lists:
[Liste der berechtigten Anwender von BYOD und wozu sie Zugang haben]
[Liste der erlaubten BYOD, sowie deren jeweiligen Einstellungen]
[Liste der verbotenen BYOD Anwendungen]
Bezüglich der Wirksamkeitskriterien wäre auch eine Gesamtliste aller Kriterien sinnvoll, weil das wäre doch die Bewertungsmatrix für Klausel 9.1?
Regarding the efficacy criteria, a complete list of all criteria would make sense, because that would be the evaluation matrix for clause 9.1?
Answer: These lists are described in the text of the BYOD policy itself, and since they are very simple, organizations can use free form instead of having defined templates.
Of course an organization can add more lists considering other criteria it wants to control (e.g., from which locations the devices can access organization's systems, on which days and hours, etc.).
This article will provide you further explanat ion about BYOD policy:
- How to write an easy-to-use BYOD policy compliant with ISO 27001 https://advisera.com/27001academy/blog/2015/09/07/how-to-write-an-easy-to-use-byod-policy-compliant-with-iso-27001/ -
Corporate Integrity Declaration
Answer:
ISO 9001:2015 has no explicit requirement for a “Corporate Integrity Declaration”, but if one of your relevant interested stakeholders requires, it becomes a requirement for your organization, but not because of ISO 9001:2015.
The following material will provide you information about suppliers/vendors:
ISO 9001 – How to evaluate supplier performance according to ISO 9001:2015 - https://advisera.com/9001academy/blog/2015/10/27/how-to-evaluate-supplier-performance-according-to-iso-90012015/
free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
GDPR Encryption
Answer:
The EU GDPR is quite broad when it comes to security of processing. It uses terms like ”appropriate” or “adequate” to refer to the safeguards that must be in place to protect personal data. The reason behind is that usually pieces of legislation are meant to be in force for a long period of time and remain unchanged as much as possible to ensure a stable legal environment. Referring to specific security measures would mean that the GDPR should undergo permanent changes and put unnecessary burden on the entities which must comply with it. Thus, the law maker actually leaves the controllers and processors to choose what security measures should be in place and only refers to as examples to “pseudonymisation” and “encryption” as examples (art.32(1)a EU GDPR).
To put it bluntly, as long as they are lawful, any security measures can be used to protect personal data, what matters is that you are able to ensure “confidentiality, integrity, availability and resilience “.
In our EU GDPR implementation toolkit https://advisera.com/eugdpracademy/eu-gdpr-documentation-toolkit/ there is a dedicated folder ( 8. Security of Personal Data) which contain various policies and procedures that you might find useful.
You may as well turn to ISO 27001 which is a very good framework for data security, and check out our article “Does ISO 27001 implementation satisfy EU GDPR requirements?” that you may find at https://advisera.com/27001academy/blog/2016/10/17/does-iso-27001-implementation-satisfy-eu-gdpr-requirements/ -
Best practice
Answer:
The EU GDPR does not distinguish between production and non-production environments.
As long as personal data is concerned, information technology systems processing personal must be adequately protected as to ensure the ongoing, confidentiality, integrity, availability and resilience as required by Article 32 Security of Processing of the EU GDPR (https://advisera.com/eugdpracademy/gdpr/security-of-processing/).
So, in strict EU GDPR terms, it does not matter the environment where the data is stored if the requirements of Article 32 mentioned above are considered. -
GDPR and possible software changes
Answer:
The documents provided in the EU GDPR implantation toolkit https://community.advisera.com/topic/eu-gdpr-documentation/ are meant to be cross industry so, as long as EU GDPR is applicable to a certain entity the documents can be used.
Of course , depending on the industry some document might be more relevant than others, but nevertheless at least all of the documents marked as mandatory in out EU GDPR toolkit List of documents should be considered.
As you mentioned that you are a software development company I think that the “Privacy Notices” might be particular useful, and our EU GDPR implementation toolkit provides in folder 2 “Personal Data Policy Framework” a “ General Data Protection Notice ” that can be used as a template to develop “Privacy Notices” for your software products.
Another important topic would most likely be implementing the Privacy by design and Privacy by default principles as set forth in Article 25 of the EU GDPR ( https://advisera.com/eugdpracademy/gdpr/data-protection-by-design-and-by-default/) .
If your software are meant, for example, to process sensitive personal data or to profile or predict the behavior of data subject then a DPIA should be also performed. A full guide on how to perform DPIAs as well as the necessary templates can be found in folder 5 “Data Protection Impact Assessment” of our EU GDPR implementation toolkit. You can also check out our webinar in DPIAs at: https://advisera.com/eugdpracademy/webinar/seven-steps-of-data-protection-impact-assessment-dpia-according-to-eu-gdpr-free-webinar-on-demand/ -
Audit tools suggestion
I want you to be my professional role model for advise and guidance. I have five years IT Audit experience using applicable frameworks. Can you please advise me on best Audit management tools that is compatible with ISO 27001 .
Answer: To support audit activities I suggest you take a look at the free version of our ISO 27001/ISO 22301 Internal Audit Toolkit at this https://advisera.com/27001academy/iso-27001-22301-internal-audit-documentation-toolkit/
This toolkit can help you plan and perform the tasks related to internal audits and record corrective actions and nonconformities, and it is fully compliant with ISO 27001 requirements.