Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Can you certify to AS9102?
Answer:
Unlike AS9100, you cannot be certified against AS9102. AS9102 is a support standard that gives you the best practice for First Article Inspection, but is not required for AS9100 certification, nor is it designed to be certified against.
If you want to know more about the support standards for AS9100 see this article: https://advisera.com/9100academy/blog/2017/10/23/how-does-as9101-as9102-as9103-relate-to-as9100-rev-d/ -
Certification and compliance
Answer:
Each country has its own legislative and regulatory framework. Normally, in Europe there is no requirement for certification. About chemical compounds to introduce in the European Union you should check Regulation (EC) No 1907/2006. -
Certification scope
Answer:
I understand that you are asking if your organization should certify the remaining 8 branches that are not yet certified. The scope of implementation it is not a technical decision, it is a business decision based on your business objectives:
- If the certificate is required by some of your customers, then those customer probably defined what should be the scope
- Sometimes it is not possible to exclude some of the departments/locations/organizational units outside of the scope because they are too crucial part of the process
- Sometimes it is desirable to exclude some of the departments/locations/organizational units because they are not important for e.g. QMS.
Once your organization decide this, then you can go and make an arrangement with the certification body about the scope of certification. The main concern of the certification body is t he avoidance of misleading information.
The following material will provide you information about correction, corrective and preventive actions:
- ISO 9001 – How to define the scope of the QMS according to ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/how-to-define-the-scope-of-the-qms-according-to-iso-90012015/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/ -
Continual improvement vs step change improvement
Both sound same meaning.
Answer:
Continuous improvement, or Kaizen, is a method for identifying opportunities for streamlining work and reducing waste. The practice was formalized by the popularity of Lean / Agile / Kaizen in manufacturing and business, and it is now being used by thousands of companies all over the world to identify savings opportunities.
Continuous Improvement is an evolutionary process. But extraordinary threats and opportunities require a revolutionary, targeted response. When an organization needs to act quickly to ramp up production, reduce costs, or meet other extraordinary changes or goals is where the step change improvement comes to action.Step change improvement is a significant change in policy or attitude, especially one that results in an improvement or increase. -
How to become GDPR expert
Sure, our DPO course will include the certification exam. -
Mapping of risks to ISO 27001 controls
Answer: Once you have identified the risk you should first look at the controls section objectives to find the one that are the most probable to treat the risk (some risk may be treated by controls from different sections). Once you find the section you should look into the controls description to find which ones are most adequate.
For example, for the risk "loss of a notebook", you can identify the following section objectives, and respective controls:
- Objective from section A.6.2 (Mobile devices and teleworking): To ensure the security of teleworking and use of mobile devices. Applicable control: Mobile device policy (A policy and supporting security measures shall be adopted to manage the risks introduced by using mobile devices.)
- Objective from section A.11.2 (Equipment): To prevent loss, damage, theft or compromise of assets and interruption to the organization’s operations. Applicable controls: Security of equipment
and assets off-premises (Security shall be applied to off-site assets taking into account the different risks of working outside the organization’s premises.) and Unattended user equipment (Users shall ensure that unattended equipment has appropriate protection.)
This material will provide you further explanation about matching risks to controls:
- Diagram of ISO 27001:2013 Risk Assessment and Treatment process https://info.advisera.com/27001academy/free-download/diagram-of-iso-270012013-risk-assessment-and-treatment-process -
Scope definition
Regarding the video tutorials, please check the "Repository" at the top left corner of your screen in Conformio. From there you can find the subfolder "Video Tutorials". Consult this screenshot as a reference: https://www.screencast.com/t/T5rLxMgc3UJz
Since your scope is limited to IT, you should include in the scope only the IT personnel, but it is important that you state in your scope who is responsible for the information security regarding employees that have access to IT systems and resources in each branch (e.g., someone in headquarters or the head of each branch). To see more information about this issue, please read the section Interfaces and dependencies from the article "How to define the ISMS scope" (https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/) that was also included in the previous post.
You can exclude elements from the scope (e.g fax or printers) only if they are not related to the information your ISMS is propose d to protect. For example, fax or printers located on branches that cannot be used to sent or print information related to the systems in your ISMS scope can be excluded from the scope. -
IT risk identification
Answer: According to ISO 27001, you must establish a risk assessment methodology, which involves:
1) Defining how to identify the risks that could cause the loss of confidentiality, integrity and/or availability of your information
2) Defining how to identify the risk owners
3) Defining criteria for assessing consequences and assessing the likelihood of the risk
4) Defining how the risk will be calculated
5) Defining criteria for accepting risks
For risk identification, the most common approach is the identification of assets and threats and vulnerabilities related to them.
These articles will provide you further explanation about risk assessment:
- ISO 27001 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
- How to write ISO 27001 risk assessment methodology https://advisera.com/27001academy/knowledgebase/write-iso-27001-risk-assessment-methodology/
- ISO 27001 risk assessment: How to match asse ts, threats and vulnerabilities https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-how-to-match-assets-threats-and-vulnerabilities/
These materials will also help you regarding risk assessment:
- Book ISO 27001 Risk Management in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/
- The basics of risk assessment and treatment according to ISO 27001 [free webinar on demand] https://advisera.com/27001academy/webinar/basics-risk-assessment-treatment-according-iso-27001-free-webinar-demand/