Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11272 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Can we handle ISO 27001 implementation remotely?
Thank you -
Risks in ISO 9001
I have also some question during consulting process but I have to study more on the spirit of ISO 9001-2015. But now I would like to give you question relating to item Risk-based thinking as follows:
1. Does organization shall address the risk for the realization or for all process or only for critical process ?
2. Risk-based thinking for all processes of system is described by establishing a documented information under support procedure ?
3. Does Risk-based thinking is a new thinking to be set in mind for personnel having work affecting quality and then records from problem solving, taking decision, eliminating risk,...can demonstrate that. So that no need to have procedure to analyse risk as well as for risk evaluation ?
Once again thanks a lot your support.
Answers:
1. The organization needs to consider entire context of the organization not only the processes, but it doesn't mean that you need to identify risks for each process. You can conduct a global assessment on the organizational leve l and that can be enough, then again you can go into details, it depends on needs of organization, the standard allows a lot of freedom regarding this requirement.
2. Documented procedures exist to prevent risk of noncomplying with the activities in the processes and in that sense they are used for avoiding risk. Also some activities like inspection or monitoring certain parameters within the process serve as precaution. But not all processes carry such risk within them so there doesn't have to be a documented procedure for each process.
3. Addressing risks and opportunities belongs to planning phase of the QMS so it is a requirement related mainly to top and mid management not employees. The management of the company should think about risks and opportunities related to the QMS and take actions to address them.
For more information, see: How to address risks and opportunities in ISO 9001 https://advisera.com/9001academy/blog/2016/06/21/how-to-address-risks-and-opportunities-in-iso-9001/ -
Design Coordination Manager
Answer:
Yes, one of the Design Coordination Manager tasks is to ensure that overall service strategies are reflected in the service design practice and, additionally, that design of the service solution meets business outcomes and customer requirements.
Read the article "Design coordination process – creating a solid foundation" https://advisera.com/20000academy/blog/2013/07/31/design-coordination-process-creating-solid-foundation/ to learn more. -
How to integrate ISO 27001: 2013 with HIPAA security rules
Thank you for explaining. My understanding is HIPAA security rules can be easily accommodated by implementing ISO 27001: 2013 in letter and sprite. Because HIPAA security rules specify three requirements i.e: Security should be managed Administratively, technically and physically and this is pretty much the same concept of ISO 27001:2013 standard. -
To whom will the auditor speak to?
Answer: During the ISMS audit both internal and external (certification) auditor has the right to speak to anyone in the company, so he can speak to people from IT department, security department, to the CEO or to any business department.
The point of the audit is to find out whether the employees are complying to the policies and procedures, and these documents are not only applicable to security department.
This free online training explains the whole audit process: ISO 27001 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/ -
Information security board
Answer: ISO 27001 does not define any requirements for information security boards, this phrase is not even mentioned in the standard. If you wish, you can organize some kind of a body that will coordinate information security activities, but it is not mandatory, and you can organize its work any way you want.
On the other hand, the role of the top management in a company is strictly defined by ISO 27001 - you'll learn about it in these articles:
- Roles and responsibilities of top management in ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2014/06/09/roles-and-responsibilities-of-top-management-in-iso-27001-and-iso-22301/
- Why is manag ement review important for ISO 27001 and ISO 22301? https://advisera.com/27001academy/blog/2014/03/03/why-is-management-review-important-for-iso-27001-and-iso-22301/ -
ISO 9001 implementation form scratch
Answer:
The first step in the implementation is to conduct GAP analysis to determine to what extent your company has already met requirements of the standard and what needs to be done to achieve the full compliance (Here you can find free GAP analysis tool https://advisera.com/9001academy/iso-9001-gap-analysis-tool/). Once you determine this, you can create the project plan (here you can download free Project Plan for ISO 9001 implementation https://info.advisera.com/9001academy/free-download/project-plan-for-iso-9001-implementation-ms-word) and define activities responsibilities and deadlines for the project.
After you finish implementing the standard, you need to conduct internal audit and management review and hire a certification body to conduct certification audit. For more information, see: Checklist of ISO 9001 implementation & certification steps https://advisera.com/9001academy/knowledgebase/checklist-of-iso-9001-implementation-certification-steps/ -
Excluding certain departments from the ISMS scope
Answer: Yes, ISO 27001 allows you to set the scope of your ISMS for only one part of your organization. However, this is not recommendable for smaller organizations (smaller than 100 employees) - this is because all parts of your organization that will be outside of the scope will be treated as an "outside world" which means you will need to protect the information within the ISMS scope from those departments which are outside of the scope.
This problem is described in detail in this article: Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/
For a larger organization, it is quite normal to go with a smaller scope, because the project is going to be quicker and cheaper .
Read also: How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/ -
Attesting to ISO 27001 compliance
However, many folks I work with often inquire about or request some form of attestation of compliance (e.g. not certification, but some form of attestation that they are compliant with the standard). My inquiry was more about that… Can anyone attest to 27001 compliance (internally or via a third party)? Perhaps a bit of a grey area…
Answer: Internal audit is mandatory according to ISO 27001, so this is something you must do - however this internal audit has no relevance for the outside world. For the third parties, only the ISO certificates issued by certification bodies are recognized.
Here are a couple of articles about the internal audit:
- How to prepare for an ISO 27001 internal audit https://advisera.com/27001academy/blog/2016/07/11/how-to-prepare-for-an-iso-27001-internal-audit/
- Qualifications for an ISO 27001 Internal Auditor https://advisera.com/27001academy/blog/2015/03/30/qualifications-for-an-iso-27001-internal-auditor/
- How to make an Internal Audit checklist for ISO 27001 / ISO 22301 https://advisera.com/27001academy/knowledgebase/how-to-make-an-internal-audit-checklist-for-iso-27001-iso-22301/
I’m guessing in such cases it really boils down to the ‘opinion’ of the person / party providing the attestation and their willingness to stake their reputation on such a claim. Correct?
Answer: I would say this is primarily a question of credibility - if the "certificate" is issued by a company that has no license for performing the certification, who would trust them? -
Questions during the internal audit
Answer:
Answers on the question asked during internal audit should provide you evidence on whether requirements of the standard are met or not. Usually, the questions provide you with yes or no answers and all requirements of the standard should be covered during the internal audit. Here you can find interesting articles on the topic:
- Writing an Audit Checklist for ISO 9001 Processes https://advisera.com/9001academy/blog/2014/11/25/writing-audit-checklist-iso-9001-processes/
- How to create a check list for an ISO 9001 internal audit for your QMS https://advisera.com/9001academy/blog/2016/07/12/how-to-create-a-check-list-for-an-iso-9001-internal-audit-for-your-qms/
There is no particular part of the system that you have to be f ocusing on by default. You should pay special attention to the most complex processes and the ones in which the probability of spotting nonconformities is the highest.