Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11268 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Implementation of ISO 13485
Answer:
Implementation process of ISO 13485 is not so different from other management system standards. After obtaining management support for the implementation, you need to conduct GAP analysis to determine to what extent your company is already compliant with ISO 13485 and determine what needs to be done to achieve full compliance with the standard.
Next step is to develop project plan where you will define all activities to be taken and documents to be created, as well as responsibilities, resources and deadlines. Then you can start implementing new processes and changing existing ones and creating necessary documentation.
Once you implement the standard, you need to conduct internal audit and management review to make sure that your system is compliant with the standard and finally you can hire certification body to conduct certification audit and issue your company the certific ate. For more information, see: Diagram of ISO 13485:2016 Implementation Process https://advisera.com/9001academy/free-downloads// -
PDCA cycle in ISO 9001
Answer:
PDCA (Plan-Do-Check-Act) cycle is one of the most important principles of ISO 9001:2015, clauses and requirements are arranged according to this cycle.
Clauses from 4 to 7 are part of the "Plan" phase, they require you to determine context of the organization, define quality policy, address risks and opportunities, establish quality objectives and provide resources for the QMS.
Clause 8 belongs to "Do" phase, here you need to operate and control your key processes, form sales and purchasing to design and development to production.
Clause 9 represents "Check" phase that includes monitoring and measuring of your processes, measuring customer satisfaction, conducting internal audit and management review. For more information, see: How to implement the Check phase (performance evaluation) in the QMS according to ISO 9001:2015 https://advisera.com/9001academy/blog/2015/11/17/how-to-implement-the-check-phase-performance-evaluation-in-the-qms-according-to-iso-90012015/
Clause 10 represents "Act" phase where you define and execute corrective actions and other actions aiming continual improvement of the QMS.
For more information, see: Plan-Do-Check-Act in the ISO 9001 Standard https://advisera.com/9001academy/knowledgebase/plan-do-check-act-in-the-iso-9001-standard/ -
PII and free text fields in information systems
Answer:
The concern is valid. A sugested protection in this case would be to include a text in the page that contains the free text field explictly informing that in that specific text filed no PII is required and that by including PII the user is assuming the risk to exposed his/her information. Of course, this solution should be review by a lawyer regarding legal issues you organization must be compliant with. -
ISO 27018 and EU PDPR
Answer:
The thoguth about go for ISO 27001 certification bringing some parts of ISO 27018 is the correct one, since ISO 27018 is not certifiable.
Concerning EU GDPR, ISO 27018 can really help to accomplish compliance, mainly with chapter IV:
Chapter II (principles): basic orientation to application of controls
Chapter III (rights of the data subject): ISO 27018 clauses can be applied in terms of service
Chapter IV (controller and processor: controls and procedures can make use of ISO 27018 recommendations. Clause 32 is of special interest.
Chapter V (transfer of personal data to third countries or international organisations): ISO 27018 clauses can be applied in terms of service.
Chapter VI (independent supervisory authorities): ISO 27018 clauses can be applied in terms of service
Chapter VII (cooperation and consistency): ISO 27018 clauses can be applied in terms of service
Chapter IX (specific data processing situations): controls and procedures can make use of ISO 27018 recommendations. -
Document labeling
For printed documents, yes. -
BYOD policy
Answer:
Generally companies have an unique BYOD (Bring Your Own Device) policy that establishes rules about the use of personal devices (smartphones, tablets, etc.) in the network or the IT infrastructure of the company.
Anyway, this document is not mandatory in ISO 27001, although can be a best practice. This article can help you to write a BYOD policy “How to write an easy-to-use BYOD policy compliant with ISO 27001” : https://advisera.com/27001academy/blog/2015/09/07/how-to-write-an-easy-to-use-byod-policy-compliant-with-iso-27001/
And also this article can help you to know more about the mandatory documents (and non mandatory) in ISO 27001 ”List of mandatory documents required by ISO 27001 (2013 revision)” : https://advisera.com/27001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-27001-2013-revision/
And maybe out template can be also interesting for you (you can see a free version clicking on “Free demo” tab) “Bring Your Own Device (BYOD) P olicy” : https://advisera.com/27001academy/documentation/bring-your-own-device-byod-policy/
Finally, these materials will help you to know more about the ISO 27001 and the BYOD policy:
- free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/
- book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/ -
Risk management and different standards
So could you please providing me by the requirement of risk management in each standard
I am looking for word to get your reply as soon as possible.
Answer:
Non of the standard you mentioned requires risk management, they only require risk assessment and ISO 9001 doesn't even require risk assessment. Here is what each of the standards require:
ISO 9001 - addressing risks and opportunities - meaning that you need to identify risks and opportunities regarding the QMS and take actions to address them. It doesn't require developing methodology for addressing risks and opportunities neither procedures and records. For more information, see: How to address risks and opportunities in ISO 9001 https://advisera.com/9001academy/blog/2016/06/21/how-to-address-risks-and-opportunities-in-iso-9001/
ISO 14001 - addressing risks and opportunities and identification and evaluation of environmental aspects - requirements for risks and opportunities are the same as for ISO 9001 but you need to focus on environmental aspects and compliance obligation in addition to context of the organization. For more information, see: Risks and opportunities in ISO 14001:2015 – What they are and why they are important https://advisera.com/14001academy/blog/2016/03/07/risks-and-opportunities-in-iso-140012015-what-they-are-and-why-they-are-important/
On the other hand, identification and evaluation of environmental aspects require organization to establish criteria for determining significant environmental aspects. For more information, see:
- ISO 14001 risks and opportunities vs. environmental aspects https://advisera.com/14001academy/blog/2016/06/06/iso-14001-risks-and-opportunities-vs-environmental-aspects/
- 4 steps in identification and evaluation of environmental aspects https://advisera.com/14001academy/knowledgebase/4-steps-in-identification-and-evaluation-of-environmental-aspects/
- ISO 22000 - hazard analysis - the standard requires hazard analysis regarding food safety and for this purpose it require organization to conduct HACCP (Hazard Analysis and Critical Control Points) analysis. Again, this is only risk assessment methodology but not requirement for the full risk management.
- ISO 13485 and ISO/TS 16949 - FMEA - this two standards require organization to conduct FEMA (Failure Mode Effect Analysis) risk assessment methodology for production, purchasing and design process. For more information, see:
- ISO 9001 vs. ISO 13485 https://advisera.com/9001academy/blog/2015/01/21/iso-9001-vs-iso-13485/
- ISO 9001 vs ISO/TS 16949 https://advisera.com/9001academy/blog/2014/10/01/iso-9001-vs-isots-16949/
- ISO 50001 doesn't even mention risks or hazards and it has completely different to establishing management system. -
How to implement ISO 9001
No, SWOT analysis can be used during definition of the context and addressing risks and opportunities but it is not mandatory. If you decide to apply SWOT analysis, you can do it at the beginning of the implementation and there is no need to apply it at every implementation step. -
ISO 9001 implementation
Answer:
In order to implement ISO 9001, you need to conduct the GAP analysis first to determine to what extent your company already meets requirements of the standard (Here you can find free GAP analysis tool https://advisera.com/9001academy/iso-9001-gap-analysis-tool/). Once you determine what requirements are left to fulfill, you need to develop project plan for the implementation and define activities, responsibilities and deadlines for the project. Here you can find free Project Plan for ISO 9001 implementation https://advisera.com/9001academy/free-downloads//
Once you implement all retirements of the standard, you need to conduct internal audit and management review to make sure that you are fully compliant with the standard. Then you can hire certification body to conduct the audit and issue you the certificate. For more information, see: Checklist of ISO 9001 implementation & certification steps https://advisera.com/9001academy/knowledgebase/checklist-of-iso-9001-implementation-certification-steps/ -
Context and risks and opportunities in ISO 9001
ISO 9001:2015 requires that the company identify a risk management plan, does this plan fall in as a QMS or safety and health?
Answer:
I'm not sure if I understand the question but, beside interested parties and definition of the scope you need to consider internal and external issues relevant to your company QMS. For example, internal issues can be organizational structure, organization culture, resources needs, etc. while external issues might be condition on the market, availability of raw materials, tax policy of the company, etc. For more information, see: How to identify the context of the organization in ISO 9001:2015 https://advisera.com/9001academy/knowledgebase/how-to-identify-the-context-of-the-organization-in-iso-90012015/
ISO 9001 does not require risk management plan or any other document regarding risks. It only requires risks and opportunities to be identified and addres sed and to monitor and evaluate effectiveness of the actions taken to address risks and opportunities. It shouldn't be mixed with occupational health and safety or environmental risks since its focus is on quality and there is no requirement to establish methodology or write a procedure. For more information, see: How to address risks and opportunities in ISO 9001 https://advisera.com/9001academy/blog/2016/06/21/how-to-address-risks-and-opportunities-in-iso-9001/