Search results

Home / Search

Category:
Select
Select

11271 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • New implementation: ISO 27001:2013 + ISO 27002:2022

    This will depend on the date you want to be certified. In case you want to be certified before March 2023 - go with 2013 revision, after March 2023 go with 2022 revision.

    Please note that after the release of the new version of ISO 27001, any required changes will have a transition period to be implemented (in general this transition period is of two years after a change in a management system standard is released, which is plenty of time to do this transition for most controls).

    For further information, see:
    - 11 most important facts about changes in ISO 27001/ISO 27002 https://advisera.com/27001academy/blog/2022/02/09/iso-27001-iso-27002/ 
    - Should you start implementing ISO 27001 2013 or 2022 revision? https://advisera.com/insight/chatbot-implement-iso-27001-2013-or-2022-revision/

  • Failed Change

    Incidents (based on failed change) should be recorded as incidents. Since you know that incidents are caused by poorly implemented change – I assume you know the root cause. If not, resolve the incident and open a problem to find out the root cause. And eliminate it.

     

    PIR should analyze the whole case to learn why did this happen and what to do not to repeat it. Improvement or corrective action should follow up.

     

    Number of incidents based on the implemented change is a good KPI for the process (efficiency).

     

    See the article „Post Implementation Review – Buzzword, or mighty tool?“ https://advisera.com/20000academy/blog/2015/02/03/post-implementation-review-buzzword-or-mighty-tool/ to give you few ideas related to PIR.

  • Detailed explanation of 11 new security controls in ISO 27001:2022

    Only controls from ISO 27001 Annex A may be excluded. All requirements from clauses 4 to 10 are mandatory if you want to be compliant with ISO 27001.

    For further information, see:

  • ISO/IEC 17025 Certificate duration

    ISO 17025 accreditation is valid for the length of the specified accreditation cycles. This period varies depending on the accreditation body and sector. The accreditation bodies must comply with the ILAC (International Laboratory Accreditation Cooperation) policy that accreditation cycles must not be longer than 5 years. Typically, this period is four years for some laboratories, but for others, it can be as short as two years or the maximum five years. Accreditation cycles begin at the date of the decision for granting assessment. After that date, accreditation bodies perform surveillance assessments to continually monitored the competency and compliance of the laboratory. A full reasseement must be scheduled, and accreditation granted before the expiry date of the certificates.

    For specific information for your laboratory, I advise you to contact the accreditation body you will use for assessment. This information should be available on their websites, as it is policy-driven.

    For more information have a look at the webinar What are the steps in the ISO 17025 accreditation process? at https://advisera.com/17025academy/webinar/what-are-the-steps-in-the-iso-17025-accreditation-process-free-webinar/

  • ISMS 27001 processes

    1- I am in the process of setting up the ISMS with your tool kit. What I miss (or haven't found) the processes (structure) for change management or patch management.

    To be compliant with ISO 27001 you only need a Change Management Policy, which can be found in folder 08 Annex A Security Controls >> A.12 Operations Security

    For an optional more robust documentation (this is not required for ISO 27001), please take a look at this toolkit:

    It is designed for compliance with ISO 20000, but can be adjusted to be used with ISO 27001. IT covers the following documents:

    • Request for Change and Change Record- Minutes of Meeting CAB
    • Change Schedule
    • Change Management Process
    • Change Management Policy

    For further information, see:

    2 - As well as the subdivision into management, core and support processes. This is required for the process landscape.

    Regarding processes classification, ISO 27001 does not require processes to be mapped. It is not generally required for the toolkit implementation (for that you only need to implement the documentation in the order they are presented in the toolkit’s folders).

    In a general manner, you can consider this classification:

    • management processes: management review
    • core processes: risk management, security operations, processes monitoring
    • supporting processes: document and record management, internal audit

    • Design and Development Agreement

      Do you have a template for "Design and Development Agreement". I mean for outsourced process?

    • External audits

      No, a certified organization must go through yearly surveillance audits. It is not an ISO 9001 requirement, it is a requirement from your organization’s contract with the certification body.

    • Design and Development Agreement

      No, we do not have a direct Design and development agreement, but we do have a document that is part of the folder 10_Purchasing and evaluation of supplier, 10.7_Appendix_7_Quality_Agreement_for_Subcontractor, that covers what is necessary for the provider of outsourced process. You can just tailormade it for the design process. 

    • Gaps From MDR to CFR

      There are some differences between documentation. You can find it in the following article:

      For any other questions, do not hesitate to contact us.

    • Risk-based approach

      Yes, a risk-based approach is a requirement stated in 4.1.2 of the ISO 13485:2016 - apply a risk-based approach to the control of the appropriate processes needed for the quality management system. This means that for each process you need to be aware of possible risks that can occur, and you must have a mechanism for how to control them. 

      Definitively it can be in a table where you will have your processes, risks than can occur, and then control measures.

      Some approaches regarding the risk you can find in the following article:

Page 89-vs-13485 of 1128 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +