Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11272 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
ISO/ITIL for startup
Assuming you have defined the scope (since you are startup, most probably - whole organization, but read the article "How to define the scope of the SMS in ISO 20000" https://advisera.com/20000academy/blog/2015/06/02/how-to-define-the-scope-of-the-sms-in-iso-20000/ to help yourself) and certification body, you can use this free implementation diagram to guide you through implementation:
"ISO 20000 implementation diagram" https://info.advisera.com/20000academy/free-download/iso-20000-implementation-diagram
This article will help you with documentation structure "How to structure ISO 20000 documentation" https://advisera.com/20000academy/blog/2016/09/27/how-to-structure-iso20000-documentation/
This free material will provide you with different implementation options:
Comparison matrices for ITIL / ISO 20000 implementation solutions https://advisera.com/20000academy/comparison/
and, if you decide to do it by yourself, you can use "ISO 20000 Documentation Toolkit" https://advisera.com/20000academy/iso-20000-documentation-toolkit/ to speed up the implementation. -
Context of the organization and risks in ISO 14001
Answer:
Internal and external issues represents any kind of impact on your environmental management system. For example, internal issues are company's organizational structure, culture, processes, type of the technology or raw materials used in the production or service delivery process, etc. External issues are the ones coming from outside the company, e.g. environmental conditions in the region where your company is, environmental legislation, requirements of the local community, environmentalists, etc. For more information about context of the organization, see: Determining the context of the organization in ISO 14001 https://advisera.com/14001academy/knowledgebase/determining-the-context-of-the-organization-in-iso-14001/
Regarding clause 6.1.1, ISO 14001 requires organization to determine risks and opportunities related to environmental aspects, compliance obligations and internal and external issues. Such risks and opportunities need to be identified on global level of the organization which means that the top management must be included in the process. The standard does not require organizations to use some methodology so the most simple way to address this clause is to arrange a brainstorming session involving all relevant people in the company and discuss risks and opportunities and the risks and opportunities identified need to be documented and some actions to address them should be proposed. For more information, see: Risks and opportunities in ISO 14001:2015 – What they are and why they are important https://advisera.com/14001academy/blog/2016/03/07/risks-and-opportunities-in-iso-140012015-what-they-are-and-why-they-are-important/ -
Assets to consider in an inventory
Great, this helps a lot! -
Change Management and Configuration Management
Answer:
Configuration Items (CIs) that are within the scope of the plan are used by the Change Management process to evaluate and authorize changes. The Change Management process authorizes all changes on CIs which are within the scope of the SACM Plan.
So, while planning how to populate CMBD (which is in jurisdiction of Configuration management, or Service Asset and Configuration Management) you need to think about scope ("width" and "depth" of the implementation i.e. affected CI's), location, naming nomenclature, tools..etc. Once you define that i.e. have your plan ready, you can start the implementation. In scope of the planning you need to consider how (i.e. who, in which tool and with what authority) people involved in change Management will use information stored in CMDB.
Here are the article that may help:
"What is the role of the Service Asset and Conf iguration Manager according to ITIL/ISO 20000?" https://advisera.com/20000academy/blog/2016/11/01/what-is-the-role-of-the-service-asset-and-configuration-manager-according-to-itil-iso20000/
"How to use ITIL to prepare the Service Asset & Configuration Management Plan" https://advisera.com/20000academy/blog/2015/12/01/how-to-use-itil-to-prepare-the-service-asset-configuration-management-plan/
"Three main activities to set up ITIL Service Asset and Configuration Management" https://advisera.com/20000academy/blog/2015/07/14/three-main-activities-to-set-up-itil-service-asset-and-configuration-management/
as well as free webinar
"The basic elements of ITIL Service Asset and Configuration Management (SACM)" https://advisera.com/20000academy/webinar/the-basic-elements-of-itil-service-asset-and-configuration-management-sacm-free-webinar-on-demand/ -
Is the risk assessment done before the BIA?
Answer: ISO 22301 (and most of other business continuity methodologies) allow you to do it either way, and the truth is - I don't think there is a huge difference. My personal preference is to do the risk assessment first, because then you'll have a better impression of which incidents can happen while doing your business impact analysis.
You'll learn more here: Risk assessment vs. business impact analysis https://advisera.com/27001academy/knowledgebase/risk-assessment-vs-business-impact-analysis/ -
How to describe treatment options
Answer: In the Risk treatment table, when you select the option "Transfer of a risk to a third party", then you shouldn't select the control in the next column; instead, you should simply write what is your intended action - in your case you should write "Purchase an insurance policy."
By the way, in the video tutorial about Risk treatment plan (that you received with your toolkit), you'll see more examples on how to fill out these treatment options. -
Inventory of assets
Answer: In the Impact column you should copy the information from the Consequence column from the Risk assessment table. In the column Notes you should input any additional information you consider relevant regarding the asset that is not fit in any other column, e.g., Asset maintenance contract is valid only until xx/xx/xxxx.
This article will provide you further explanation about inventory of assets:
- How to handle Asset register (Asset inventory) according to ISO 27001 https://advisera.com/27001academy/knowledgebase/how-to-handle-asset-register-asset-inventory-according-to-iso-27001/
These materials will also help you regarding inventory of assets:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Integrating ISO 9001 and ISO 27001
I have few clarifications.
1.We are implementing QMS as well as ISMS .
Can we have a common document for Document_and_Record_Control taking care of QMS/ISMS requirements.
If you have a combined format can you please share.
Also any other Common procedures of ISMS used by QMS ?
You can merge the Procedure for Document and Record Control for ISO 9001 and ISO 27001 into one, especially because the requirements are practically the same. Beside this procedure, you can also merge Procedure for Human Resources, Procedure for Management of Nonconformities and Corrective Action, Procedure For Internal Audit and Procedure for Management Review. Unfortunately, we currently do not have Integrated Documentation Toolkit for ISO 9001 and ISO 27001 so we do not have combined procedure. Here is one whitepaper that can be useful for mapping common requirements of ISO 9001 and ISO 27001, it refers to ISO 9001:2008 but you will get an idea:
- ISO 9001 vs. ISO 27001 matrix https://info.advisera.com/9001academy/free-download/iso-9001-vs-iso-27001-matrix/
2. Second clarification is on Risk management. In the templates , Procedure_for_Addressing_Risks_and_Opportunities is about performing risk analysis for QMS level or enterprise level risk management . How to modify to cover for project management risk . Is it like project managers/QA manager use same risk methodology . And critical risk from projects gets highlighted to QA Manager and get listed in enterprise level risks? Please suggest
You can use the procedure for assessing project management risks, basically, instead of writing risks regarding context of the organization, you will assess risks for the project but those risks and not a part of the risks related to the context of the organization but for individual projects.
3) Do you have a Change control procedure in the template for 9001 ? I couldn't find one in template
We do not have such procedure because ti is not mandatory, all information about the changes are stated in the Quality Manual. Here is one article about the integration of ISO 9001 and ISO 27001, that can be helpful to you:
- How to integrate ISO 9001 and ISO 27001 https://advisera.com/9001academy/blog/2016/09/27/how-to-integrate-iso-9001-and-iso-27001/ -
ISO 9001:2008 question.
Thank you so much Strahinja. You've confirmed my point unless it's stated in the client's procedure the frequency of the boiler being serviced it cannot be considered as a nonconformity. -
Resolving 14001 certification audit findings
Dear Strahinja, thank you for invaluable expertise and advice! I have a question in reference to ISO 9001:2008, can I post it here or on the 9001 blog?