Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11272 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Controls applicable to suppliers
Answer: Basically you will have to apply the same controls your risk assessment identified as applicable if you were running the operation yourself, plus the controls related to supplier management, identified in Annex A.15 of ISO 27001
This article will provide you further explanation about controls applicable to suppliers:
- 6-step process for handling supplier security according to ISO 27001 https://advisera.com/27001academy/blog/2014/06/30/6-step-process-for-handling-supplier-security-according-to-iso-27001/
These materials will also help you regarding controls applicable to suppliers:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Procedure for management of NC and CA
Answer: Yes. New versions of both ISO 14001 and ISO 27001 have a lot of requirements in common, and treatment of non conformities and corrective actions is one of them. You will only have to take care to adjust some expressions in the procedure to also refer to information security non conformities and corrective actions, and include the proper records in the section management of records. But if you want to take a look at a free demo of a procedure wrote specifically for ISO 27001 ISMS you can access this link: https://advisera.com/27001academy/documentation/procedure-for-corrective-action-2/
You only have to scroll down the screen a little to find the free demo tab.
These materials will also help you regarding procedure for management of non conformities and corrective actions:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 O n Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/ -
Expanding ISMS scope
Thanks for the prompt reply -
Risk treatment and SOA
1- Controls that were already implemented before the Project for ISO 27001 Implementation started, how should they be mentioned in the Statement of Applicability?
Answer: They should be stated as applicable like all other controls identified as necessary by your risk assessment. The one thing that will change is the justification, since they were not based on the results of risk assessment. You can say, for example, that they were implemented by customer request, legal requirement, or as a best practice of the industry.
This article will provide you further explanation about the Statement of Applicability:
- The importance of Statement of Applicability for ISO 27001 https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/
2 - In the Risk Treatment Table: If more than one control can be implemented to reduce a Risk, is implementing one control suffi cient?
Answer: If you evaluate that after the implementation of the first control the risk level will decrease to an acceptable value you do not need to implement other controls. You only have to verify after the effective implementation if you achieved the desired security level. After evaluating the results you can confirm that other controls are not necessary or if you have to make some additional implementation.
This article will provide you further explanation about Risk treatment:
- ISO 27001 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
These materials will also help you regarding Risk treatment and the Statement of Applicability:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- The basics of risk assessment and treatment according to ISO 27001 [free webinar] https://advisera.com/27001academy/webinar/basics-risk-assessment-treatment-according-iso-27001-free-webinar-demand/ -
Requirements for corrective action
the standard not make that mandatory to record it on corrective action form?
Answer: The documentation of the correction process is no longer mandatory for the standard (it is now an organization decision to document or not a procedure). It only requires that the nature of the nonconformities, subsequent actions taken, and results of corrective actions, to be retained as documented information.
This article will provide you further explanation about mandatory documents and records for ISO 27001:
- List of mandatory documents required by ISO 27001 (2013 revision) https://advisera.com/27001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-27001-2013-revision/ -
Design and development process
I was not clear on how to cover the design aspects and supervision aspects processes.
Answer:
In order to align the design process with ISO 9001:2015, you need to implement all requirements of the standard from the clause 8.3. This includes defining the design and development planning, defining design and development inputs, outputs and controls and also how the changes in the design will be handled. For more information, see: The ISO 9001 Design Process Explained https://advisera.com/9001academy/blog/2013/11/05/iso-9001-design-process-explained/
I'm not sure what you mean by supervision process, I assume you meant of supervision of the production process. This process and controls for this process are defined in clauses 8.1 and 8.5. You need to define criteria for the process and products, along w ith necessary documented information. The controls to be implemented should ensure that the product and production process is compliant with the standard and expectations of the organization. For more information, see: ISO 9001:2015 clause 8.5 Product realization – Practical examples for compliance https://advisera.com/9001academy/blog/2015/11/03/iso-90012015-clause-8-5-product-realization-practical-examples-for-compliance/ -
ISMS scope definition
Answer: Sure, as the main process in your ISMS scope this is a perfect choice considering your consultancy business. But you also should consider the size and location of your activities to define your scope, since for small or medium business, working from a single location, it is more practical to certify the business as a whole instead of handle a particular process.
This article will provide you further explanation about ISMS scope definition:
- How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
- Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/
This material will also help you regarding ISMS scope definition:
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
USA laws and regulations related to ISO 27001
Answer: We have a free article that can help you with that: Laws and regulations on information security and business continuity https://advisera.com/27001academy/knowledgebase/laws-regulations-information-security-business-continuity/
Regarding documentation, I suggest you to take a look at the free demo of our List of Legal, Regulatory, Contractual and Other Requirements, which can help you organize the requirements you identify as relevant. The link to the template is https://advisera.com/27001academy/documentation/list-of-legal-regulatory-contractual-and-other-requirements/
You only have to scroll down the screen a little to find the free demo tab. -
Corrective action process
1 - Is it an expectation that anyone within the organisation can complete a corrective action form? Or should it be directed through a central location e.g. the service desk for them to complete?
Answer: the standard only requires that corrective actions are performed when needed after a nonconformity is encountered. How to handle a corrective action is an organization decision, and both approaches you mentioned are valid ones. You only have to ensure that people who handle a corrective action are properly trained in doing so and that results of any corrective action are retained as documented information .
2 - Would it be appropriate to post the form on our intranet and direct all our people to it for them to complete and then submit the form?
Answer: In terms of the standard this point is indifferent (this is another "how" situation, and the standard only defined "what" must be done), but for an organization's operational purposes this is a good idea, because it makes easier to find the form.
3 - Presumably this is to evidence continual improvement?
Answer: Yes. Together with evidences of implemented opportunities for improvement, documented information about corrective actions are evidences that the management system is being improved over the time.
This article will provide you further explanation about Corrective action process:
- Practical use of corrective actions for ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2013/12/09/practical-use-of-corrective-actions-for-iso-27001-and-iso-22301/
These materials will also help you regarding Corrective action process:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free Tutorial: How to Write ISO 27001 Procedure for Corrective Action https://advisera.com/27001academy/tutorial/free-tutorial-how-to-write-iso-27001-procedure-for-corrective-action/ -
Assessing risks and opportunities
Answer:
All the risks that affect the QMS and the organization need to be addressed, regardless of the fact that the company faced them earlier. If these, let's say, old risks haven't been addressed properly and they still exist, they should be addressed again.
The way of dealing with the risks is to define actions to address the risks. You need to define what needs to be done, who will do it, what resources are needed and what is the deadline for the action.
The risks can be turned into opportunity, but the opportunity itself is perceived only as something positive. Whet trying to identify the opportunities, you need to ask yourself what can be done better, what can be improved and so on.
For m ore information about risks and opportunities, see: How to address risks and opportunities in ISO 9001 https://advisera.com/9001academy/blog/2016/06/21/how-to-address-risks-and-opportunities-in-iso-9001/