Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
KPI for QMS MR
Answer:
If I had to design KPI for a Quality Management System Representative, I would start by the end, by the purpose, by the reason for its existence. What does your organization want from the QMS MR? One important outcome should be to get and maintain certification. Another can be quality and timing of information about the QMS performance, and another can be about customer satisfaction, complains and lost customers as a measure of customer promotion in the QMS.
The following material will provide you information about the Management Representative:
ISO 9001 – What is the job of the quality management representative? - https://advisera.com/9001academy/knowledgebase/what-is-the-job-of-the-quality-management-representative/
How to comply with new leadership requirements in ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/how-to-comply-with-new-leadership-requirements-in-iso-90012015/
What will be the destiny of the management representative in the ne w ISO 9001:2015? - https://advisera.com/9001academy/knowledgebase/what-will-be-the-destiny-of-the-management-representative-in-the-new-iso-90012015/
free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
IT policy development
Answer: According to ISO 27001, the main issues you should consider in the development of policies and procedures are: legal requirements (e.g., laws and contracts), results of risk assessments and top management decisions (e.g., decisions based on strategic or operational plans and objectives).
Considering your specific scenario, you also should consider a cross evaluation of the requirements related to each country involved, as well as the contracts related to cloud providers (e.g., cloud providers may have operations in additional countries that also should be evaluated.
I suggest you to take a look at the free demo of our Operating Procedures for Information and Communication Technology at this link: https: //advisera.com/27001academy/documentation/operating-procedures-for-information-and-communication-technology/
This document will give you an idea on ahat to consider to to ensure correct and secure functioning of information and communication technology.
This article will provide you further explanation about policy development:
- Seven steps for implementing policies and procedures https://advisera.com/27001academy/knowledgebase/seven-steps-for-implementing-policies-and-procedures//
These materials will also help you regarding policy development:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Policies approval process
Answer: First of all, to be sure about which policies the Governance board should approve you need to verify the current set of roles and responsibilities defined to it (e.g., the documented top management decision that established the Governance board). In general, policies can be divided in two types:
- High level policies, which define the organization's approach to broad issues, like quality policy, information security policy and IT security policy.
- Support policies, which define the organization's approach to specific issues, normally related to a high level policy like development polic y, information classification policy and access control policy.
Normally, a Governance board is responsible to approve high level policies, delegating the approval of support policies to specific roles in the organization, such as the HR department head or the IT senior manager.
Regarding how to name the policies, the word "standard" has a general understanding that is different from the purpose of a policy, then you should avoid use it to designate a policy not to cause confusion. A better approach would be to use the word "policy" to refer to high level policies approved by the Governance board and terms like "support policy", "detailed policy" or "complementary policy" to indicate policies that are related to a high level policy.
These articles will provide you further explanation about policies development:
- One Information Security Policy, or several policies? https://advisera.com/27001academy/blog/2013/06/18/one-information-security-policy-or-several-policies/
- 8 criteria to decide which ISO 27001 policies and procedures to write https://advisera.com/27001academy/blog/2014/07/28/8-criteria-to-decide-which-iso-27001-policies-and-procedures-to-write/
This material will also help you regarding policies development:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/ -
Publishing personal data
Answer:
You can transfer personal data to the US if certain safeguard are in place such as the Model Clauses or consent. In your particular case if you display the birthday dates I would suggest you either to find a legitimate interest to do that or stop showing them. Consent taken from employees is not considered valid consent under most circumstances. -
BS 10012: 2017
Answer:
Currently there are no GDPR certification system in place. The certification bodies are yet to emerge. I would recommend to stick with the GDPR and leave the certifications for the moment when they will be endorsed by the competent EU authorities. -
Performing DIPA in companies
Answer:
Regardless of the size of the company you must perform a DPIA if the processing activity is likely to constitute a high risk to the rights and freedoms of the data subjects. If you don’t have any processing activities that would be considered as a high risk then DPIA won't be necessary. However be careful when assessing which processing activities are of high risk. Our EU GDPR implementation toolkit https://advisera.com/eugdpracademy/eu-gdpr-documentation-toolkit/ has a section dedicated to DPIAs and there you can find guidance as well as templates. -
Right to object
Answer:
The right to object to marketing is an absolute right so no controller cannot deny you that right. Referring to the right to object to other types of processing, any request must be assessed by the controller and if there is no legal ground for the processing activity; for example there is no legitimate interest then the processing activity must cease. However keep in mind that certain services cannot be offered to individuals without processing their data so in this case the services will have to cease being offered. -
Internal auditors competence requirements
Answer:
Yes he can. The only requirements for being an internal auditor are: not auditing own work/department and being competent. It is up to your organization to determine what is a competent auditor. If you have job descriptions, describe there what are your requirements for the job of internal auditor.
The following material will provide you information about internal auditors:
ISO 9001 – ISO 9001 internal auditor training: Is it for me? - https://advisera.com/9001academy/blog/2015/06/02/iso-9001-internal-auditor-training-is-it-for-me/
free online training ISO 9001:2015 Internal Auditor Course – https://advisera.com/training/iso-9001-internal-auditor-course/ -
Data Processors and DIPA
Answer:
The EU GDPR states that DPIAs should be performed by data controllers. This is because the controller are the ones taking the decisions as regards to the purposes and means of the processing. However processors might also be called up to provide support to controllers when they are performing DPIAs if a part of the processing activity which is subject of the DPIA is outsourced to the processor. The processor must assist the controller should the controller need to carry out a privacy impact assessment. Art. 28(3)(f)