Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Risk Treatment Plan Template
Answer: To have a better understanding of our Risk Treatment Table I suggest you to take a look at the free demo provided through the link: https://advisera.com/27001academy/documentation/risk-treatment-table/
With this table you can determine options for the treatment of risks and appropriate controls for unacceptable risks. This table also includes a catalogue of options for treatment of risks as well as a catalogue of 114 controls prescribed by ISO 27001.
Our templates are based on ISO 27001 standard, so I also suggest this material to better understand the risk assessment and risk treatment process:
- Book ISO 27001 Risk Management in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/
I also suggest you to consider purchase our Risk Assessment Toolkit (https:// advisera.com/27001academy/iso-27001-22301-risk-assessment-toolkit/), so you can have the complete set of documents aligned with ISO 27001 and make the adjustments to integrate them with your already implemented process. We would charge you only the price difference with what you already spent. -
Standards for IT procedures and policies
Answer: For definition of IT Security and Operation Security policies complaint with ISO standards you should consider ISO 20000 (for IT service management) and ISO 27001 (for Information security management). By considering these standards, you can develop policies and procedures to ensure proper IT operations and protection of information.
If your focus is on information security, I suggest you to take a look at the free demo of our Operating Procedures for Information and Communication Technology at this link: https://advisera.com/27001academy/documentation/operating-procedures-for-information-and-communication-technology/
The purpose of this document is to ensure correct and secure functioning of information and communication technology.
If your focus is on information technology, I suggest you to take a look at the free demo of our ISO 20000 Documentation Toolkit at this link: https://advisera.com/20000academy/iso-20000-documentation-toolkit/
This toolkit will help you implement, operate manage an efficient and secure IT service process.
These materials will provide you further explanation about ISO 20000 and ISO 27001:
- How to implement ISO 27001 and ISO 20000 together https://advisera.com/27001academy/blog/2015/03/16/how-to-implement-iso-27001-and-iso-20000-together/
- How to integrate ISO 27001 and ISO 20000 [free webinar on demand] https://advisera.com/27001academy/webinar/how-to-integrate-iso-27001-and-iso-20000-free-webinar-on-demand/
2. My second question is that I am writing new Process document & guidelines for customer.. I am planing to used ISO standard only.
Need help to understand how to write Process & guidelines according ISO standard.
Answer: For developing and implementing procedures I suggest you the following articles:
- Seven steps for implementing policies and procedures https://advisera.com/27001academy/knowledgebase/seven-steps-for-implementing-policies-and-procedures//
- 8 criteria to decide which ISO 27001 policies and procedures to write https://advisera.com/27001academy/blog/2014/07/28/8-criteria-to-decide-which-iso-27001-policies-and-procedures-to-write/ (the orientations applied here for ISO 27001 documents also can be applicable to other documents in general). -
Vulnerability identification
Answer: You understanding is correct. Complicated procedures are prone to errors and the impacts you mentioned, and depending upon the results of your analysis and evaluation the application of security controls may be required.
This article will provide you further explanation about risk analysis:
- ISO 27001 risk assessment: How to match assets, threats and vulnerabilities https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-how-to-match-assets-threats-and-vulnerabilities/
This material will also help you regarding risk analysis:
- Book ISO 27001 Risk Management in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/ -
GDPR compliant
Answer:
How about a self assessment? You could use the "EU GDPR Readiness Assessment" and besides the answers also gather documentation to prove compliance. By the way, you should be able to answer Yes to all questions applicable to you. You could also engage a third party to perform an audit. The audit should focus both on processes and documents with a special focus on your Inventory of processing activities and DPIAs.
Also bear in mind that no body as of yet can certify that you are GDPR compliant. Certification bodies are yet to be established. -
Comité de Calidad
Mi respuesta: Dentro del Plan de Proyecto pude ser definida la organización del proyecto, donde estarían incluidos: - el promotor del proyecto: no participa activamente en el mismo. El gerente del proyecto del proyecto debe informar regularmente al promotor del proyecto acerca del estado del mismo; éste interviene si el proyecto está paralizado. - el gerente del proyecto: su función es coordinar el proyecto, garantizar los recursos necesarios para su implementación, informar al promotor sobre el progreso del proyecto y realizar trabajos administrativos relacionados con el mismo. La autoridad del gerente del proyecto debe ser tal que garantice la implementación ininterrumpida del proyecto dentro de los plazos establecidos. - el equipo del proyecto: su fun ción es ayudar en diversos aspectos de la implementación del proyecto, realizar tareas preestablecidas y tomar decisiones sobre diversos temas que requieren un enfoque multidisciplinario. El equipo del proyecto se reúne antes de completar cada versión final de un documento y, en otros casos, cuando el gerente del proyecto lo considere necesario. Estos materiales pueden ayudarle con respecto a la implementación de ISO 9001: 2015: - Libro "Preparación para el proyecto de implementación ISO: una guía en un lenguaje sencillo": https://advisera.com/books/preparacion-para-el-proyecto-de-implementacion-iso-una-guia-en-un-lenguaje-sencillo/ - Curso gratuito en línea: Curso de Fundamentos ISO 9001: https://advisera.com/es/formacion/curso-fundamentos-iso-9001/ - Conformio (herramienta en línea para ISO 9001): https://advisera.com/conformio/ -
Risk assessment report
Answer: The risk assessment report should be a separated document from the risk assessment, because its purpose is to to present to top management the main results of the risk assessment, while the risk assessment document contains all information gathered, analysed and evaluated about the risks in the organization.
This article will provide you further explanation about the risk assessment process:
- ISO 27001 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
These materials will also help you regarding risk assessment and treatment process:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- The basics of risk assessment and treatment according to ISO 27001 [free webinar on dem and] https://advisera.com/27001academy/webinar/basics-risk-assessment-treatment-according-iso-27001-free-webinar-demand/ -
Need for Data Protection Impact Assessment
Answer:
As stated in the webinar DPIAs are not necessary to all processing activities, but only for those activities that may be considered as high risk to the rights and freedoms of the data subjects. Our EU GDPR implementation toolkit https://advisera.com/eugdpracademy/eu-gdpr-documentation-toolkit/ contains also threshold assessment which is meant to help you identify high risk processing activities. -
Performing DPIA
Answer:
DPIAs are not depended on the size of the company but are related only to the processing activities. If you acting as a sole trader that would perform processing activities that would fall into the high risk category a DPIA would be needed. -
BCMS performance indicators
Answer: At this moment we do not have specific examples of performance metrics for a BCMS, but I suggest you to take a look at this article so you can have ideas from an ISMS perspective that can be adapted to a BCMS:
- Key performance indicators for an ISO 27001 ISMS https://advisera.com/27001academy/blog/2016/02/01/key-performance-indicators-for-an-iso-27001-isms/
For example:
- Percent of business initiatives supported by the ISMS may be changed to Percent of business initiatives supported by the BCMS
- Percent of information security initiatives containing cost/benefit estimates may be changed to Percent of business continuity initiatives containing cost/benefit estimates
- Percent of agreements with information security clauses may be changed to Percent of agreements with business continuity clauses
- Numb er of security-related service downtimes may be changed to Number of service disruptions
- Duration of service interruptions can be maintained
- Incident resolution time may be changed to Achieved recovery time
- Percent of controls assessment performed may be changed to Percent of BCP tests performed
- Number of improvement initiatives can be maintained
This material will also help you regarding BCMS metrics:
- Book Becoming Resilient: The Definitive Guide to ISO 22301 Implementation https://advisera.com/books/becoming-resilient-the-definitive-guide-to-iso-22301-implementation/ -
Who should implement IATF 16949
(a) there is a requirement in the contract that you should follow this standard,
(b) there is no mentioning of this, but cited that one should follow generally accepted practice in the industry, applicable standards, etc. (a vague reference to compliance with the applicable "rules"), and
(c) if nothing is said at all (could this AITF-standard possibly be considered as future industry practice?).
How specific are the demands of those who will need to follow the IATF standard? May I ask for any illustration about this? Is the standard just about to keep order and stay organized in general or is there more specific requirements that are measurable and can more easily be said to violate?
It would also be interesting to know if there is any supervisory body and if there are any sanctions if you do not do what is required.
Answer:
Implementation of the standard is not mandatory in sense of legal requirement, but if the customer requires it, you should implement it in order to keep the customer. The standard itself requires from the organization to require either IATF 16949 or ISO 9001 from its suppliers, so ISO 9001 is very minimum required from the companies supplying the IATF 16949 certified companies.
The standard represents the set of rules and best practices in the industry and covers all processes related to the manufacturing of the product, as well as requirements for continual improvement. Most of the requirements are general because they should apply to different types of industries and different types of companies and the requirements are in most cases regarding the organization and managing the processes. For more information, see: What is IATF 16949? https://advisera.com/16949academy/what-is-iatf-16949/
There is a supervisory body, and it is called certification body. You can hire them to audit your system and issue you a certificate to testify that you are compliant with the standard. In case when there are nonconformities found during the certification audit, you will get a report about the nonconformities and once you remove the nonconformities, you will get the certificate. For more information, see: Checklist of IATF 16949:2016 implementation steps https://advisera.com/16949academy/knowledgebase/checklist-of-iatf-16949-2016-implementation-steps/