Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11275 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Internal and external records
Answer:
The organization needs to control internal and external documents related to the QMS. Regarding the internal documents, the organization needs to define distribution, access, retrieval and use, along with storage, preservation, control of changes and retention and disposition. As far as external documents are concerned, the organization needs to identify them and control them.
In ISO 9001:2015 there are no requirements for documenting the way of document control or to maintain any record about the document and record control. For more information, see: New approach to document and record control in ISO 9001:2015 https://advisera.com/9001academy/blog/2015/06/30/new-approach-to-document-and-record-control-in-iso-90012015/ -
Communication requirements of ISO 9001:2015
Answer:
There is no one way to meet requirements of clause 7.4. Depending on the needs of the organization, you can develop one centralized communication process and develop a procedure for communication where you will define what will be communicated, when, with whom, how and by who. The second option is to define these information for each process within the process procedures.
In my opinion, the second option is better because all relevant people will have necessary information about the communication within their own process procedure and there will be no need for additional communication procedure. For more information, see: Communication requirements according to ISO 9001:2015 https://advisera.com/9001academy/blog/2016/11/01/communication-requirements-according-to-iso-9001-2015/ -
Organizational context and Risk Assessment Report
Answer: Clauses 8.2 and 8.3 from the standard require you to document the results of the risk assessment - they don't specifically require the "Report", but some kind of document that shows what risks were assessed and treated at a particular date, and excel sheets or tools used on operational activities are not very good for this purpose because they are intended to be changed any time to included changes in the risk environment.
Besides that, you also provide a document to top management where you can present the risk assessment methodology and compile, highlight and present the main risks and treatments in a forma t they are used to read (executive summary, main findings, recommendations, etc.).
In the video tutorials that came with your toolkit, you can see examples of how to fill out all the Risk assessment and Risk treatment Report.
2 - For the part “Understanding the organization” there is something called “Internal and external issues”. I think I understand but I am not sure. Can you please give me some examples of internal and external issues?
Answer: Examples of internal issues are organizational culture, assets, methodologies and policies. External issues examples are new technologies, geographical location, market conditions, and
government's laws.
This article will provide you further explanation about internal and external issues:
- Explanation of ISO 27001:2013 clause 4.1 (Understanding the organization) https://advisera.com/27001academy/knowledgebase/how-to-define-context-of-the-organization-according-to-iso-27001/ -
Controls applicable to suppliers
Answer: Basically you will have to apply the same controls your risk assessment identified as applicable if you were running the operation yourself, plus the controls related to supplier management, identified in Annex A.15 of ISO 27001
This article will provide you further explanation about controls applicable to suppliers:
- 6-step process for handling supplier security according to ISO 27001 https://advisera.com/27001academy/blog/2014/06/30/6-step-process-for-handling-supplier-security-according-to-iso-27001/
These materials will also help you regarding controls applicable to suppliers:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Procedure for management of NC and CA
Answer: Yes. New versions of both ISO 14001 and ISO 27001 have a lot of requirements in common, and treatment of non conformities and corrective actions is one of them. You will only have to take care to adjust some expressions in the procedure to also refer to information security non conformities and corrective actions, and include the proper records in the section management of records. But if you want to take a look at a free demo of a procedure wrote specifically for ISO 27001 ISMS you can access this link: https://advisera.com/27001academy/documentation/procedure-for-corrective-action-2/
You only have to scroll down the screen a little to find the free demo tab.
These materials will also help you regarding procedure for management of non conformities and corrective actions:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 O n Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/ -
Expanding ISMS scope
Thanks for the prompt reply -
Risk treatment and SOA
1- Controls that were already implemented before the Project for ISO 27001 Implementation started, how should they be mentioned in the Statement of Applicability?
Answer: They should be stated as applicable like all other controls identified as necessary by your risk assessment. The one thing that will change is the justification, since they were not based on the results of risk assessment. You can say, for example, that they were implemented by customer request, legal requirement, or as a best practice of the industry.
This article will provide you further explanation about the Statement of Applicability:
- The importance of Statement of Applicability for ISO 27001 https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/
2 - In the Risk Treatment Table: If more than one control can be implemented to reduce a Risk, is implementing one control suffi cient?
Answer: If you evaluate that after the implementation of the first control the risk level will decrease to an acceptable value you do not need to implement other controls. You only have to verify after the effective implementation if you achieved the desired security level. After evaluating the results you can confirm that other controls are not necessary or if you have to make some additional implementation.
This article will provide you further explanation about Risk treatment:
- ISO 27001 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
These materials will also help you regarding Risk treatment and the Statement of Applicability:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- The basics of risk assessment and treatment according to ISO 27001 [free webinar] https://advisera.com/27001academy/webinar/basics-risk-assessment-treatment-according-iso-27001-free-webinar-demand/ -
Requirements for corrective action
the standard not make that mandatory to record it on corrective action form?
Answer: The documentation of the correction process is no longer mandatory for the standard (it is now an organization decision to document or not a procedure). It only requires that the nature of the nonconformities, subsequent actions taken, and results of corrective actions, to be retained as documented information.
This article will provide you further explanation about mandatory documents and records for ISO 27001:
- List of mandatory documents required by ISO 27001 (2013 revision) https://advisera.com/27001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-27001-2013-revision/ -
Design and development process
I was not clear on how to cover the design aspects and supervision aspects processes.
Answer:
In order to align the design process with ISO 9001:2015, you need to implement all requirements of the standard from the clause 8.3. This includes defining the design and development planning, defining design and development inputs, outputs and controls and also how the changes in the design will be handled. For more information, see: The ISO 9001 Design Process Explained https://advisera.com/9001academy/blog/2013/11/05/iso-9001-design-process-explained/
I'm not sure what you mean by supervision process, I assume you meant of supervision of the production process. This process and controls for this process are defined in clauses 8.1 and 8.5. You need to define criteria for the process and products, along w ith necessary documented information. The controls to be implemented should ensure that the product and production process is compliant with the standard and expectations of the organization. For more information, see: ISO 9001:2015 clause 8.5 Product realization – Practical examples for compliance https://advisera.com/9001academy/blog/2015/11/03/iso-90012015-clause-8-5-product-realization-practical-examples-for-compliance/ -
ISMS scope definition
Answer: Sure, as the main process in your ISMS scope this is a perfect choice considering your consultancy business. But you also should consider the size and location of your activities to define your scope, since for small or medium business, working from a single location, it is more practical to certify the business as a whole instead of handle a particular process.
This article will provide you further explanation about ISMS scope definition:
- How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
- Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/
This material will also help you regarding ISMS scope definition:
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/