Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Disaster recovery and ISO standards
Answer: For Disaster recovery and business continuity the recommended ISO standards are ISO 22301, ISO 22313, and ISO 27031.
ISO 22301 covers the requirements for a business continuity management system, which will help you identify, implement, operate, control and improve the most relevant business aspects to be supported by business continuity and disaster recovery practices.
ISO 22313 covers guidance on how to implement ISO 22301 requirements, business continuity and disaster recovery plans.
ISO 27031 cover guidance on how to implement business continuity and disaster recovery plans on Information and Communication Technology.
For an example of a cycle from establishment of business continuity requirements to a complete plan, please see these articles:
- How to write business continuity plans? https://advisera.com/ 27001academy/blog/2010/04/08/how-to-write-business-continuity-plans/
- Business continuity plan: How to structure it according to ISO 22301 https://advisera.com/27001academy/knowledgebase/business-continuity-plan-how-to-structure-it-according-to-iso-22301/
This article will provide you further explanation about ISO standards related to business continuity and disaster recovery:
- ISO 22301 vs. ISO 22313 https://advisera.com/27001academy/blog/2013/05/21/iso-22301-vs-iso-22313/
- Understanding IT disaster recovery according to ISO 27031 https://advisera.com/27001academy/blog/2015/09/21/understanding-it-disaster-recovery-according-to-iso-27031/
These materials will also help you regarding disaster recovery:
- Book Becoming Resilient: The Definitive Guide to ISO 22301 Implementation https://advisera.com/books/becoming-resilient-the-definitive-guide-to-iso-22301-implementation/
- Writing a business continuity plan according to ISO 22301 [free webinar on demand] https://advisera.com/27001academy/webinar/writing-a-business-continuity-plan-according-to-iso-22301-free-webinar-on-demand/ -
ISMS gap analysis
Answer: Sure. To verify the current status of your ISMS you can use our Free ISO 27001 Gap Analysis Tool at this link: https://advisera.com/27001academy/free-iso-27001-gap-analysis-tool/
This tool can help you see how much of ISO 27001 you have implemented so far, considering the management system requirements and security controls. -
List of requirements template
Answer: In the "requirement" column you must write what is the requirement to be fulfilled (e.g., only authorized personnel can have access to customer information). In the column "document stipulating the req" you must write the document that defines the requirement (e.g., law xyz, contract abc, etc.).
Unfortunately we do not have an specific tutorial or webinar for filling this document, but included in the toolkit you bought you can schedule a meeting with one of our experts, so he can help you filling this document, or you can ask for a review of the document you finished, and we will provide you our comments on what you can improve in your document so it can be compliant with the standard.
You can schedule a meeting with one of our experts at this link: https://advisera.com/27001academy/consultation/
This article will provide you further explanation about requirement's identification:
- How to identify ISMS requirements of interested parties in ISO 27001 https://advisera.com/27001academy/blog/2017/02/06/how-to-identify-isms-requirements-of-interested-parties-in-iso-27001/ -
Cryptography and ISMS
As a cryptography technology, you should consider the applicability of controls from section A.10 (Cryptography) from ISO 27001 Annex A. These controls will help you ensure proper and effective use of cryptography, either by defining which technologies can be used, when, how, and by whom, as well as how cryptographic keys will be protected through their whole life cycle.I suggest you take a look at the free demo of our Policy on the Use of Cryptographic Controls at this link: https://advisera.com/27001academy/documentation/policy-on-the-use-of-encryption/, so you can have a view of how this policy looks like.
This article will help you regarding ISO 27001 cryptographic controls:
- How to use the cryptography according to ISO 27001 control A.10 https://advisera.com/27001academy/blog/2015/12/14/how-to-use-the-cryptography-according-to-iso-27 001-control-a-10/ This material will also help you regarding ISO 27001 cryptographic controls: - ISO 27001 Annex A Controls in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/
-
iso27001 and iso20000
Answer: Although Information Technology and Information Security belong to different domains, they have a considerable overlap that requires that any organizational unit responsible for them to work together. For example, both IT and IS require procedure for incident handling, and to fulfill its mission. Information Technology must integrate information security requirements in its implementation. Regarding information security, when defining which and how to protect information the characteristics of the IT environment should be considered to define the best approach.
These articles will provide you further explanation about integration between information technology and information security:
- Incidents in ISO 22301 vs. ISO 27001 vs. ISO 20000 vs. ISO 28003 https://advisera.com/27001academy/blog/2016/09/05/incidents -in-iso22301-vs-iso27001-vs-iso-20000-vs-iso28003/
- ISO 27001 vs. ITIL: Similarities and differences https://advisera.com/27001academy/blog/2016/03/07/iso-27001-vs-itil-similarities-and-differences/
These materials will also help you regarding integration between information technology and information security:
- How to integrate ISO 27001 and ISO 20000 [free webinar on demand] https://advisera.com/27001academy/webinar/how-to-integrate-iso-27001-and-iso-20000-free-webinar-on-demand/ -
Documentación ISO 14001:2015
Mi respuesta:
En la nueva versión de la norma hay sólo unos pocos documentos obligatorios que no necesariamente tienen que tener el formato de un procedimiento y son los siguientes:
- Alcance del SGA (cláusula 4.3)
- Política ambiental (cláusula 5.2)
- Riesgos y oportunidades a abordar y procesos necesarios (cláusula 6.1.1)
- Criterio para la evaluación de aspectos ambientales significativos (cláusula 6.1.2)
- Aspectos ambientales con impactos ambientales asociados (cláusula 6.1.2)
- Aspectos ambientales significativos (cláusula 6.1.2)
- Objetivos ambientales y planes para conseguirlos (cláusula 6.2)
- Control operacional (cláusula 8.1)
- Preparación y respuesta a emergencias (cláusu la 8.2)
Además existen una serie de registros obligatorios que la organización necesita mantener como: Registro de obligaciones de cumplimiento (cláusula 6.1.3); Registro de capacitación, habilidades, experiencia y cualificaciones (cláusula 7.2), etc
En este artículo puede encontrar los documentos y registros obligatorios así como los procedimientos más comúnmente utilizados: https://advisera.com/14001academy/es/knowledgebase/list-of-mandatory-documents-required-by-iso-140012015/
Por otro lado, una buena planificación de la implementación puede ayudar en gran medida a la hora de implementar la norma ISO 14001 y así trabajar con vistas a la certificación. Así que tome el tiempo que sea necesario para planificar y saber qué recursos se requieren, ya que esto por un lado , ahorrará tiempo a la organización y por otro, más tarde, recursos.
Para más información sobre los pasos en la implementación y certificación, puede ver: https://advisera.com/14001academy/es/knowledgebase/lista-de-pasos-para-la-implementacion-de-la-iso-14001/
Estos materiales además pueden ayudarle con la implementación de la norma ISO 14001:2015:
- Libro "Preparación para el proyecto de implementación: una guía en un lenguaje sencillo"":https://advisera.com/books/preparacion-para-el-proyecto-de-implementacion-iso-una-guia-en-un-lenguaje-sencillo/
- Curso gratuito en línea : Curso de fundamentos ISO 14001: https://advisera.com/training/es/course/curso-fundamentos-iso-14001/
- Conformio (herramienta en línea para ISO 14001): https://advisera.com/conformio/ -
Which standard to use in internal audits
You're welcomed -
Competence requirement for job position
Answer:
The requirements for competency (appropriate level of education, experience, training) is usually not included in the procedure but other documents in such as job description. The standard requires the organization to ensure that any person(s) under its control performing tasks that can impact on OH&S is (are) competent on the basis of appropriate education, training or experience, but it doesn't require organization to document competency requirements for each job position.
In order to check whether the facility manager has appropriate level of competency, and again the standard only refers to the competence regarding occupational health and safety, you need to speak with the facility manager superior or HR department and see what are the re quirements and does this person meets these requirements.Also, if some operational controls are related to this job position and require training, you need to see if there is a record that demonstrates that this person had this training, and knows how to apply these particular operational controls.
For more information, see: The importance of training and awareness in OHSAS 18001 https://advisera.com/18001academy/blog/2015/07/01/the-importance-of-training-and-awareness-in-ohsas-18001/ -
Documented information vs documents and records
Answer:
"Documented information" is the term that covers both documents and records and there is a little hint on how to determine whether the standard is requiring a document or a record. When you come across a phrase "maintain documented information", it means that you need to create a document, e.g. quality policy, the term "retain documented information as an evidence" means that you need to create a record, e.g. record about management review.
For more information, see: A new approach to documented information in ISO 14001:2015 https://advisera.com/14001academy/blog/2015/08/24/a-new-approach-to-documented-information-in-iso-140012015/
These materials will also help you regarding documentation:
- Book Managing ISO Documentation: A Plain English Guide https://advisera.com/books/managing-iso-documentation-plain-english-guide/
- Free online training ISO 14001:2015 Foundations Course https://training.a dvisera.com/course/iso-14001-foundations-course/
- Conformio (online tool for ISO 14001) https://advisera.com/conformio/