Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
QMS and CMMI in software company
Answer:
QMS or ISO 9001 has the same requirements for every industry and it is applicable to any industry as well. QMS for software companies deffer from QMS in other industries only in sense that software companies has different processes than other industries and those processes must be aligned with ISO 9001.
Capability Maturity Model Integration (CMMI) is a process improvement training and appraisal program and service administered and marketed by Carnegie Mellon University (CMU) and required by many DoD and U.S. Government contracts, especially in software development. CMU claims CMMI can be used to guide process improvement across a project, division, or an entire organization. CMMI defines the following maturity levels for processes: Initial, Managed and Defined. Currently supported is CMMI Version 1.3. CMMI is registered in the U.S. Patent and Trademark Office by CMU.
CMMI currently addresses three areas of interest:
- Product and service development — CMMI for Development (CMMI-DEV),
- Service establishment, management, — CMMI for Services (CMMI-SVC), and
- Product and service acquisition — CMMI for Acquisition (CMMI-ACQ).
CMMI was developed by a group of experts from industry, government, and the Software Engineering Institute (SEI) at CMU. CMMI models provide guidance for developing or improving processes that meet the business goals of an organization. A CMMI model may also be used as a framework for appraising the process maturity of the organization. -
EFQM and ISO 9001
Answer:
EFQM (the European Foundation for Quality Management) is a not-for-profit membership foundation in Brussels, established in 1989 to increase the competitiveness of the European economy. The initial impetus for forming EFQM was a response to the work of W. Edwards Deming and the development of the concepts of Total Quality Management.
The EFQM Excellence Model is a non-prescriptive business excellence framework for organizational management systems, promoted by EFQM (formerly known as the European Foundation for Quality Management) and designed for helping organizations in their drive towards being more competitive. The Model is regularly reviewed and refined: the last update was published in 2013.
Regardless of sector, size, structure or maturity, organizations need to establish appropriate management systems in order to be successful. The EFQM Excellence Model is a practical tool to help organizations do this by measuring where they are on the path to excellence; helping them understand t he gaps; and then stimulating solutions.
ISO 9001 can be considered as a tool for achieving EFQM in a same way it is a part of Total Quality Management
For more information, see: List of Quality Management Standards and Frameworks https://advisera.com/9001academy/knowledgebase/list-of-quality-management-standards-and-frameworks/ -
Indicators and ISO 27001
Answer:
First of all, ISO 27001:2013 does not require to use indicators, only require to set objectives, and how to measure them, including who and when will report and evaluate the results. This article can help you “How to perform monitoring and measurement in ISO 27001” : https://advisera.com/27001academy/blog/2015/06/08/how-to-perform-monitoring-and-measurement-in-iso-27001/
By the way, it is important to differentiate between the measurement and the risk assessment, because they are things completely different. This article can give you more information about the risk assessment "ISO 27001 risk assessment & treatment - 6 basic steps" : https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
Regarding the assessment to obtain a diagnostic, I am not sure if I have understood your question, but habitually the internal audit is performed to evaluate the ISMS implemented, and you can also use it as diagnostic. If you want to perform an internal audit, this article can be interesting for you “How to make an Internal Audit checklist for ISO 27001 / ISO 22301” : https://advisera.com/27001academy/knowledgebase/how-to-make-an-internal-audit-checklist-for-iso-27001-iso-22301/
Finally, our online course can be also interesting for you because we give more information about the measurement of an ISMS “ISO 27001:2013 Foundations Course” : https://advisera.com/training/iso-27001-foundations-course/ -
Is the risks evaluation necessary
Answer:
The standard requires organization to determine risks and opportunities that need to be addressed to and to keep records of such risks and opportunities. How will organization know whether the risk should be addressed or not without evaluation? The evaluation doesn't have to be structured neither any methodology is required but the organization simply must decide what risks should be addressed and this is practically evaluation.
For more information, see:
- Risks and opportunities in ISO 14001:2015 – What they are and why they are important https://advisera.com/14001academy/blog/2016/03/07/risks-and-opportunities-in-iso-140012015-what-they-are-and-why-they-are-important/ -
Alignment of ISO 9001:2015 and ISO/TS 16949
Answer:
ISO 9001:2015 no longer has the same structure as 2008 and 2000 revisions of ISO 9001. Unfortunately, ISO /TS 169494:2009 is based on ISO 9001:2008 so compliance with both standard will require changes in clause numbers for practically the same requirements. The rest of the changes made in ISO 9001:2015 compared to the previous version of the standard do not affect significantly ISO/TS 16949 since they are more additions to the existing system. We are now waiting for new version of the TS 16949 and it will probably keep the same numbering as the old one so it will probably make integration with ISO 9001 more difficult than it is now but we expect less dramatic changes compared to ISO 9001.
For more information, see:
- ISO 9001 vs ISO/TS 16949 https://advisera.com/9001academy/blog/2014/10/01/iso-9001-vs-isots-16949/
- 5 Main Changes Expected in ISO 9001:2015 from the 2014 Draft International Standard (DIS) http:/ /advisera.com/9001academy/knowledgebase/5-main-changes-expected-in-iso-90012015-from-the-2014-draft-international-standard-dis/ -
Examples of different types of assets
Answer: Sure, here's an article that suggests the assets for different categories: How to handle Asset register (Asset inventory) according to ISO 27001 https://advisera.com/27001academy/knowledgebase/how-to-handle-asset-register-asset-inventory-according-to-iso-27001/
This article may also help you: ISO 27001 risk assessment: How to match assets, threats and vulnerabilities https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-how-to-match-assets-threats-and-vulnerabilities/
Finally, this free online course explains the whole process of asset identification and risk assessment: ISO 27001 Foundation Course https://advisera.com/training/iso-27001-foundations-course/ -
ITIL and billing SW
Answer:
ITIL covers complete IT service lifecycle. That can include billing or any other SW. Usually, SW is related to an IT service (or vice-versa). So, you can apply ITIL to SW development, deployment or maintenance.
Following articles can help you:
"What is ITIL?" https://advisera.com/20000academy/what-is-itil/
"ITIL Application Management Function – Custodian of application knowledge" https://advisera.com/20000academy/blog/2014/03/18/itil-application-management-lifecycle-within-service-lifecycle/ -
Differences between ISO 27017 and ISO 27018
Answer:
Sure, the main difference is that ISO 27017 is about information security controls for cloud services (generic), and ISO 27018 is specifically developed for protecting privacy in the cloud.
Regarding document controls and assurance in the cloud using COBIT 5, we do not have specific information about this, because we are expert in ISO standards (27001, ISO 27002, ISO 22301), and the philosophy of COBIT is a bit different (has a different scheme of certification), and also remember that COBIT is specific developed for IT governance, so I am not sure if it is the best option for you.
Concluding: If you are interested in the security of cloud computing, ISO 27017 and ISO 27018 are specific standards developed for this, and also are compatible with ISO 27001 (Information Security Management System) and ISO 38500 (Governance of Information Security).
By the way, these articles can be interesting for you:
"ISO 27001 vs. ISO 27017 - Information security controls for cloud services" : https://advisera.com/27001academy/blog/2015/11/30/iso-27001-vs-iso-27017-information-security-controls-for-cloud-services/
"ISO 27001 vs. ISO 27018 - Standard for protecting privacy in the cloud" : https://advisera.com/27001academy/blog/2015/11/16/iso-27001-vs-iso-27018-standard-for-protecting-privacy-in-the-cloud/
Finally, remember that our online course is very interesting to learn the fundaments of ISO 27001 “ISO 27001:2013 Foundations Course” : https://advisera.com/training/iso-27001-foundations-course/ -
Document code for quality policy and objectives
Answer:
The standard requires documentation to be properly identified and this includes title, date, author and reference or coding number. This is the straightforward requirement of ISO 9001:2015, clause 7.5.2a) so it cannot be avoided even in case of Quality Policy and Quality Objectives.
Since Quality Policy is often public document, it doesn't have to have the coding on the version that is available publicly but the version used internally must have the coding on it, the objectives are purely internal document so they also must have the coding on them.
For more information, see: New approach to document and record control in ISO 9001:2015 https://advisera.com/9001academy/blog/2015/06/30/new-approach-to-document-and-record-control-in-iso-90012015/ -
ISO 9001 transition and ISO 14001 and OHSAS 18001 integration
Answer:
The transition is a good chance to implement additional standards and create integrated management system. First step would be to conduct gap analysis and determine to what extent your existing system is compliant with new version of ISO 9001 and what needs to be done to achieve full compliance. This should be your first input for the project plan for transition and integration with ISO 14001 and OHSAS 18001.
The second step would be to identify common requirements of ISO 14001:2015 and OHSAS 18001 and try to implement they at the same time with the transition steps for ISO 9001:2015. ISO 14001:2015 also went through the same changes as ISO 9001 so they now have same clause numbers for common requirements, ISO organization plans to replace OHSAS 18001 with ISO 45001 and this will probably happen next year so you will be ready with our experience with the transition process and knowledge about new versions of ISO 9001 and ISO 14001 and this will make your job much easier.
The next step is to implement the requirements of ISO 9001:2015, ISO 14001:20015 and OHSAS 18001:2007 and once the system is in place you will need to conduct internal audit and management review so you can be sure that your system is compliant with the standards so you can hire certification body to conduct certification audit.
Here are some articles that might be helpful to you:
- How to make the transition from ISO 9001:2008 revision to the 2015 revision https://advisera.com/9001academy/blog/2015/10/06/how-to-make-the-transition-from-iso-90012008-revision-to-the-2015-revision/
- Integrating ISO 9001 and ISO 14001 https://advisera.com/9001academy/blog/2013/11/19/integrating-iso-9001-iso-14001/
- Is integrating ISO 9001 and OHSAS 18001 that hard? https://advisera.com/9001academy/blog/2015/02/03/integrating-iso-9001-ohsas-18001-hard/