Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11293 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
ISO 27001 Presentation to Top Management
Answer: Yes. Using the link displayed below you can access a free presentation covering:
- The reasons for implementation
- The purpose of the project
- What milestones to set throughout the project
- Which resources are required
- The deliverables expected from the project
Project proposal for ISO 27001 implementation https://info.advisera.com/27001academy/free-download/project-proposal-for-iso-27001-implementation-powerpoint
This article will provide you further explanation about benefits of ISO 27001 implementation:
- Four key benefits of ISO 27001 implementation https://advisera.com/27001academy/knowledgebase/four-key-benefits-of-iso-27001-implementation/
These materials will also help you regarding benefits of ISO 27001 implementation:
- ISO 27001 benefits: How to obtain management support [free webinar] https://advisera.com/27001academy/webinar/iso-27001-benefits-how-to-get-management-buy-in-free-webinar-on-demand/ -
CISM and ISACA
Answer: We are focused on ISO management standards and related material, but we have some articles regarding how these materials can help implementation and operation of an ISMS - ISO 27001 based:
- How personal certificates can help your company’s ISMS https://advisera.com/27001academy/blog/2014/10/06/how-personal-certificates-can-help-companys-isms/
- How to integrate COSO, COBIT, and ISO 27001 frameworks https://advisera.com/27001academy/blog/2016/10/10/how-to-integrate-coso-cobit-and-iso-27001-frameworks/ -
Integrating ISO management systems
Answer: All ISO management systems published after 2012 have the same general structure, and this make integrating them a lot of easier. In the integration process you should consider two phases:
1 - Integration of the common parts of ISO management systems, e.g., control of documents, internal audit, training, management review, etc. These have basically all the same requirements, requiring only minor adjustments to refer to all systems covered
2 - Integration of the specific parts of each system (basically sections 6 and 8 of each standard). Regarding ISO 27001, this means including in the organizational process the activities related to information security risk assessment and treatment processes.
This article will provide you further explanation about integrating ISO management systems:
- How to implement integrated management systems https://advisera.com/articles/how-to-implement-integrated-management-systems/
These materials will also help you reg arding integrating ISO management systems:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free webinar – ISO 27001 implementation: How to make it easier using ISO 9001 https://advisera.com/27001academy/webinar/iso-27001-implementation-make-easier-using-iso-9001-free-webinar-demand/ -
Documentation for internal audit
Answer:
Besides Internal Audit Program, which is mandatory document, there are also internal audit checklist and internal audit plan that are not mandatory but can be very useful during the audit.
Internal audit checklist should be prepared based on the documentation audit, prior to the main audit and it contains items or requirements of the standard to be checked during the audit. For more information, see: ISO 9001 Audit Checklist https://advisera.com/9001academy/knowledgebase/iso-9001-audit-checklist/
Internal audit plan represents a schedule of the specific internal audit. In this document, you should define what processes will be audited, what people will be interviewed and so on, with detailed timing for each process and each interview. Besides providing a structure to your audit, it also provides information to the relevant people so the y can make themselves available for your audit. For more information, see: Five Main Steps in ISO 9001 Internal Audit https://advisera.com/9001academy/knowledgebase/five-main-steps-in-iso-9001-internal-audit/ -
Methodology for calculating risk
Answer: Since we are targeting smaller companies, we are using the simplest risk assessment methodology: impact is assessed with the scale Low-Medium-High (0, 1 and 2), and the likelihood is assessed using the same scale. The risk is calculated by adding those two values together.
Of course, in the document called "Risk assessment and treatment methodology" you will find a detailed description of this methodology.
This article will also help you: How to write ISO 27001 risk assessment methodology https://advisera.com/27001academy/knowledgebase/write-iso-27001-risk-assessment-methodology/ -
Information security in project management
Answer: Unfortunately we do not have a template covering Information Security in Project Management, but there are many similarities with implementing an ISMS that you can use to drive the implementation of this control:
1 - You have to define information security objectives and include them in the project objectives, the same way you define information security objectives for an ISMS aligned with organization's objectives, the only difference is that these objectives are restri cted to the scope of the project.
2 - You have to perform at the beginning, and periodically, information risk assessments in the project, like you would do it with other business processes, to identify necessary controls
3 - You have to ensure that information security practices are part of all phases of the project (e.g., from the issue of the project charter to project closing).
In short, you can think the inclusion of information security in project management as if you are going to implement a small ISMS that will fit the projects needs and be proportional to the project's lifetime and budget.
Regarding your question related to different entry points for new projects, I would recommend you to define a project management policy, establishing rules for project approval and the need to include information security as part of the project activities.
This article will provide you further explanation about Information security in project management:
- How to manage security in project management according to ISO 27001 A.6.1.5 https://advisera.com/27001academy/what-is-iso-27001/ -
Clause 5.1 i)
Answer:
Requirements of this clause are really hard to audit and to demonstrate compliance with. The best way to meet these requirements is for top management to assign roles, responsibilities and authorities within the EMS (Environmental Management System). People can only demonstrate leadership if they are authorized to make decisions.
For more information about leadership, see: How to demonstrate leadership according to ISO 14001:2015 https://advisera.com/14001academy/blog/2015/10/05/how-to-demonstrate-leadership-according-to-iso-140012015/ -
ISO 9001 in accounting
Answer:
ISO 9001 has requirements only for the processes that affect directly quality of the products and services and customer satisfaction. Therefore, the standard doesn't have any requirements regarding the accounting and it is often left out form the scope of the QMS (Quality Management System) because it makes no difference.
You can develop procedures for accounting in order to ensure that the processes are carried out as planned and make it part of QMS.
For more information about the scope of the QMS, see: How to define the scope of the QMS according to ISO 9001:2015 https://advisera.com/9001academy/knowledgebase/how-to-define-the-scope-of-the-qms-according-to-iso-90012015/ -
Internal and external records
Answer:
The organization needs to control internal and external documents related to the QMS. Regarding the internal documents, the organization needs to define distribution, access, retrieval and use, along with storage, preservation, control of changes and retention and disposition. As far as external documents are concerned, the organization needs to identify them and control them.
In ISO 9001:2015 there are no requirements for documenting the way of document control or to maintain any record about the document and record control. For more information, see: New approach to document and record control in ISO 9001:2015 https://advisera.com/9001academy/blog/2015/06/30/new-approach-to-document-and-record-control-in-iso-90012015/ -
Communication requirements of ISO 9001:2015
Answer:
There is no one way to meet requirements of clause 7.4. Depending on the needs of the organization, you can develop one centralized communication process and develop a procedure for communication where you will define what will be communicated, when, with whom, how and by who. The second option is to define these information for each process within the process procedures.
In my opinion, the second option is better because all relevant people will have necessary information about the communication within their own process procedure and there will be no need for additional communication procedure. For more information, see: Communication requirements according to ISO 9001:2015 https://advisera.com/9001academy/blog/2016/11/01/communication-requirements-according-to-iso-9001-2015/