Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Document control procedure template
Answer: Yes. You can have a printed version of a document with a higher confidentiality level too.
The access control of printed information is more difficult to be ensured than on electronic versions, that's why the text of section 3.3.2 does not mention the handling of printed versions, but it is only a suggestion.
The comments in this section explain that if an organization wants to use printed versions of more sensible information it only has to adapt the text according its needs.
With the toolkit you've bought are also included access to video tutorials that explain the document control procedure and can help you customize your document according your needs. -
BCP and ISO 27031 standard
I have all the templates from you for ISO22301 and have used them a few times so not concerned about their use. I have gone through the ISO27031 standard and can see the difference or value add of this approach for IRBC.
I would like to know;
1. How to use ISO27031, should I use it??
Answer: I would recommend you to use ISO 27031, since it can be a valuable reference to check and improve the BC Plans for IT, usually called IT disaster recovery plans, since its recommendations can show you if your plans already cover the most common controls and safeguards or if they need adjustments.
You can think the use of ISO 27031 in the same way ISO 27002 is used for ISO 27001, where ISO 27002 provides recommendations and guidelines for implementation of ISO 2 7001 Ann ex A controls.
2. Do you have documents that show how to use ISO27031.
Answer: Specifically for ISO 27031 we do not have such material, however our DRP template is compatible with 27031.
3. Having read through the standard it looks like DRP made smarter.
Answer: Yes, this is basically what ISO 27031 does, providing recommendations and guidelines to controls and safeguards applicable to IT BC plans
4. How do I marry the two?
Answer: You can consider the use of ISO 27031 in the planing phase of business continuity. After performing the BIA and defining RTO's, RPO's and general strategy, you can use ISO 27031 to detail which controls and other measures you have to consider in your DRP plans.
This article will provide you further explanation about ISO 27031:
- Understanding IT disaster recovery according to ISO 27031 https://advisera.com/27001academy/blog/2015/09/21/understanding-it-disaster-recovery-according-to-iso-27031/ -
7.1.5.2 TRAZABILIDAD DE LAS MEDICIONES
Puede excluir esta cláusula si en la empresa no cuentan con ningún equipo de medición, por lo que el responsable de esto sería el proveedor externo.
Para más información vea: https://advisera.com/9001academy/blog/2015/07/07/what-clauses-can-be-excluded-in-iso-90012015/2015/# -
Identification of legal requirements
https://advisera.com/27001academy/knowledgebase/laws-regulations-information-security-business-continuity/?utm_source=clause-27001&utm_medium=downloaded-content&utm_content=lang-en&utm_campaign=free-knowledgebase-27001
The UK requirements towards the bottom. There are 16 requirements listed so not sure if I need to include all these and our approach to it?
Answer: This list is just a general reference, and your organization should seek for expert support for identification of legal requirements relevant for your organization's industry (there may be more or less than those presented in the article).
2 - I know we also need to state our approach; is this simply by stating how we comply eg storing all HR docs in a locked cupboard marked confidential and i=unedr access con trol?
Answer: This answer will depend on what each applicable legislation is requiring. Some of them may require you to implement some kind of technology, present some specific records or reports, or implement policies. Again, you should seek for expert support regarding each applicable legislation to identify the approach required to fulfill them.
This article will provide you further explanation about how using ISO 27001 to comply with a legal requirement:
- How ISO 27001 can help suppliers comply with U.S. DFARS 7012 https://advisera.com/27001academy/blog/2017/04/24/how-iso-27001-can-help-suppliers-comply-with-usa-dfars-7012/ -
Document control procedure
Answer: The section "Reference documents" is used to list any document in the company used to define document control. These may be, for example, a documented decision from top management, an internal policy, or an industry regulation.
To identify documents to be referred in the document control procedure, you must identify which requirements, internal or external, the business must fulfil regarding documentation control.
In the toolkit you bought you have access to video tutorials that will help you filling the document control procedure.
2 - We are an IT company (a webhosting provider). Do you have documents and / or recommendations for an industry like this (what are mandatory documents and what not)? Already saw the mandatory documents list.
Answer: ISO 27001 was designed to be easily used by organizations from any industry, so mandatory documents won't change much because you are a webhosting provider - we have lots of clients that are in the same business and there was no need to have any extra security documents.
These articles will provide you further explanation about document control:
- Seven steps for implementing policies and procedures https://advisera.com/27001academy/knowledgebase/seven-steps-for-implementing-policies-and-procedures//
- 8 criteria to decide which ISO 27001 policies and procedures to write https://advisera.com/27001academy/blog/2014/07/28/8-criteria-to-decide-which-iso-27001-policies-and-procedures-to-write/
These materials will also help you regarding document control:
- Managing ISO Documentation: A Plain English Guide https://advisera.com/books/managing-iso-documentation-plain-english-guide/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Communication plans requirements
Answer: No. Both ISO 27001 and ISO 22301 require that communication requirements must be determined, but the implementation is up to the organization. So, in some cases you may have a single communication plan for multiple processes and teams (e.g., communication by Intranet), and in others you may have specific plans for specific situations (e.g., communication plan for a project or a communication plan that is part of a disaster recovery plan).
For smaller companies you can include rules for communication without emphasizing that this is a Communication plan - e.g. in the Incident management procedure you can simply define who has to notify whom through which means, and this will be completely enough.
These articles will provide you further explanation about communications requirements:
- How to create a Communication Plan according to ISO 27001 https://advisera.com/27001academy/blog/2014/10/27/how-to-create-a-communication-plan-according-to-iso-27001/
- How to handle incidents according to ISO 27001 A.16 https://advisera.com/27001academy/blog/2015/10/26/how-to-handle-incidents-according-to-iso-27001-a-16/
- Enabling communication during disruptive incidents according to ISO 22301 https://advisera.com/27001academy/blog/2016/12/19/enabling-communication-during-disruptive-incidents-according-to-iso-22301/
These materials will also help you regarding communication:
- Book Becoming Resilient: The Definitive Guide to ISO 22301 Implementation https://advisera.com/books/becoming-resilient-the-definitive-guide-to-iso-22301-implementation/
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/ -
ISO certification for universities
Answer: I'm not aware of any specific ISO standard for universities. In general you can consider the ISO 9001 for implementation of quality management and ISO 17025 for quality management in laboratories, but these will depend mostly of the university's objectives and legal requirements it must comply with. It is important to note that you have to verify with the entity that regulate engineering courses in your country which are the requirements the workshops and labs must comply with. These are your main guidance to identify ISO standards.
This article will provide you further explanation about ISO 9001 for universities:
- Should universities implement ISO 9001? https://advisera.com/9001academy/blog/2015/04/21/should-universities-implement-iso-9001/ -
AUDITORIA INTERNA
Si quiere tener éxito en la implementación de un SIG, tanto usted como los empleados de la compañía necesitan adquirir el suficiente conocimiento como para poder llevar a cabo un proyecto de tal complejidad.
Llevar a cabo el proyecto por sus propios medios es la opción más eficaz en términos de costes ya que las herramientas en línea son más baratas que contratar un consultor externo. De esta forma también se preserva la confidencialidad de información sensible de la empresa, se incrementa el compromiso de los empleados que redactan su propia documentación, y el conocimiento se mantiene dentro de la organización.
Si quiere obtener conocimientos sobre ISO 14001 puede asistir al Curso gratuito de Fundamentos de ISO 14001: https://advisera.com/training/es/course/curso-fundamentos-iso-14001/ o a cualquiera de nuestros webinars de ISO 14001: https://advisera.com/14001academy/es/webinars/
Además también se encuentra disponible un white paper que podría ayudarle en integrar ISO 14001 e ISO 9001 : https://advisera.com/14001academy/es/descargas-gratuitas/ ar-las-revisiones-2015-de-iso-9001-e-iso-14001.
En cuanto a la auditoria externa, hay muchas maneras en las que un auditor puede encontrar las respuestas a sus preguntas, como la revisión de los registros, o la observación de los empleados y las entrevistas a los mismos. Entre la información que el auditor recogerá está:
- Si todas las cláusulas han sido abordadas
- La coherencia de los procesos y si estos han sido revisados
- Las acciones correctivas que han sido implementadas donde haya sido necesario
- Si el enfoque basado en riesgos ha sido implementado
- Si existen planes para la mejora continua
- Si ha sido llevada a cabo la revisión por la dirección
Para más información, vea: https://advisera.com/9001academy/blog/2016/04/19/what-questions-to-expect-on-the-iso-9001-certification-audit/# -
Implementing private cloud
But we plan migrate new IT Org Structures in the cloud-enabled. Could you help me this structure model? Have you ready templates?
At the same time, this new IT org structure must compliance to ISO 27001, ISO 27017 ISO 27018 when I writing it. Could you help me this issues?
Answer: Unfortunately we not have templates specifically related to IT based infrastructure. But I suggest you to take a look at the free demo of our ISO 20000 Documentation Toolkit (https://advisera.com/20000academy/iso-20000-documentation-toolkit/).
Although traditional IT and cloud IT are based on very different architecture, they share many common processes (e.g., incident management, capacity management, etc.), and these are covered by the ISO 20000 standard, the basis for the ISO 20000 Documentation Toolkit
This article will provide you further explanation about ITIL (the framework from which ISO 20000 standard was developed) and cloud services:
- How ITIL can help cloud services https://advisera.com/20000academy/blog/2015/07/28/how-itil-can-help-cloud-services/
Additionally, since this toolkit is also based on an ISO standard, like the one you already bought, you will have similar information regarding which template covers which standard's clause. This will make integrating them easier.
This article will provide you further explanation about integrating management systems:
- How to implement integrated management systems https://advisera.com/articles/how-to-implement-integrated-management-systems/