Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Apply for ISO 9001
Answer:
The term "application" is not commonly used regarding ISO standard, so I assume you meant certification. There are two main steps in achieving or getting ISO 9001 certificate.
First step is implementation of the standard, meaning that your organization need to perform actions and create documentation in order to meet requirements of the standard. The second step is to hire certification body to perform certification audit and issue your organization an ISO 9001 certificate.
For more information see: Checklist of ISO 9001 implementation & certification steps https://advisera.com/9001academy/knowledgebase/checklist-of-iso-9001-implementation-certification-steps/ -
People as single point of failure
Answer:
Your question is more focused on business continuity, so I'll describe how is this usually resolved from ISO 22301 perspective - there are a couple of strategies on how to approach this problem:
a) Employ someone else who can replace certain people that are crucial
b) Write very detailed procedures so that other employees can resume doing the job
c) Make a contract with an external party that can provide you with human resources with particular skills in case that your crucial people are not available.
See also this article: Can business continuity strategy save your money? https://advisera.com/27001academy/blog/2010/03/15/can-business-continuity-strategy-save-your-money/ -
Implementing ISO 9001 in chemical industry
Answer:
Usual first step is to conduct GAP analysis and determine to what extent the organization already complies with ISO 9001:2015. You can find our free GAP analysis tool here https://advisera.com/9001academy/iso-9001-gap-analysis-tool/
Once you determine what needs to be done, you should establish Project Plan to define activities, deadlines and other relevant information. Here you can find our free Project Plan for ISO 9001 Implementation https://advisera.com/9001academy/free-downloads//
When you implement all activities from the project plan, you need to conduct internal audit to determine whether the QMS is compliant with the standard and initiate and conduct corrective actions to achieve full compliance. Here you can find our free onl ine ISO 9001:2015 Internal Auditor course https://advisera.com/training/iso-9001-internal-auditor-course/
And finally, the company needs to conduct management review and hire a certification body for certification audit.
Our documentation toolkit contains all mandatory documents required by ISO 9001:2015 along with most commonly used documents. With purchase of toolkit you will get access to video tutorials that explain how the documents are filled in. To see complete offer and all documents that are included in our toolkit, click here https://advisera.com/9001academy/iso-9001-documentation-toolkit/ -
Issue based risk assessment?
Answer:
You are right, I mean, you can perform an asset based risk assessment, although it is not mandatory in the new ISO 27001:2013 (for example, you can perform a process based risk assessment).
Regarding the issue based risk assessment, I am sorry but it does not exist in ISO 27001:2013. The “issues” are related to the context and the scope of the ISMS, so your organization simply shall consider internal and external issues to determine risks and opportunities that need to be addressed, independently of the methodology for the risk assessment.
This article can be interesting for you “Explanation of ISO 27001:2013 clause 4.1 (Understanding the organization)” : https://advisera.com/27001academy/knowledgebase/how-to-define-context-of-the-organization-according-to-iso-27001/
And also this one “How to identify interested parties ac cording to ISO 27001 and ISO 22301” : https://advisera.com/27001academy/knowledgebase/how-to-identify-interested-parties-according-to-iso-27001-and-iso-22301//
And if you are interested in the development of a methodology for the risk management, this article can be also interesting for you “How to write ISO 27001 risk assessment methodology” : https://advisera.com/27001academy/knowledgebase/write-iso-27001-risk-assessment-methodology/
And our online course can be also interesting for you because we give more information about the risk assessment “ISO 27001:2013 Foundations Course” : https://advisera.com/training/iso-27001-foundations-course/ -
Defining the scope
Answer:
From my point of view, if you have a client requiring the ISO 27001 implementation and certification, it is better if you talk with your client and agree with him your ISMS scope (to avoid problems).
Anyway, if you are giving a service to your client, and you need all systems of the data center for this service, maybe the best option would be to include in the scope all systems (I suppose that these systems are managed by your company).
This article can be interesting for you “How to define the ISMS scope” : https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
And our online course can be also interesting for you because we give more information about the ISMS scope “ISO 27001:2013 Foundations Course” : https://advisera.com/training/iso-27001-foundations-course/ -
To be compliant, what is the minimum to be done?
Answer:
Basically, there is no difference between "being compliant with the standard" and "being ready for the certification" - so the point is you have to implement:
1) all the mandatory documents
2) all the non-mandatory documents you consider necessary for your company
3) make sure all of your employees comply with all this documentation
In our ISO 27001 Documentation Toolkit you'll find a document called "List of documents" which specifies all the documents that are mandatory, and all the documents that are optional. When you follow the steps in the toolkit, you will be able to conclude which non-mandatory documents will be necessary for you.
It is also recommendable to go through this free online course because it will explain you how the whole standard works: ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Validity of an ISO 27001 Certification to an organization
With most training providers, when you get the ISO 27001 Lead Auditor certificate, there is no validity period of this certificate; however, some training providers/accreditation bodies might ask of you to maintain the certificate, this is something you need to check with the training provider.
See also these materials:
- article Accreditation vs. certification vs. registration in the ISO world https://advisera.com/blog/2016/02/29/accreditation-vs-certification-vs-registration-in-the-iso-world/
- article How to become ISO 27001 Lead Auditor https://advisera.com/27001academy/knowledgebase/how-to-become-iso-27001-lead-auditor/
- webinar ISO 27001 Lead Auditor Course preparation training https://advisera.com/training/iso-27001-lead-auditor-course/ -
Deviations and exceptions in the Information security policy
Answer:
First of all, the recommendations from ISO 27002 are not mandatory, so you do not have to write everything that is written in this standard; on the other hand ISO 27001 does not require you to define deviations and exceptions. See also this article: ISO 27001 vs ISO 27002: https://advisera.com/27001academy/knowledgebase/iso-27001-vs-iso-27002/
ISO 27002 is not quite clear on what does it mean by deviations and exceptions; generally, deviations could mean that you have to set a process of responding to nonconformities that will occur - e.g. what to do if someone is not complying with policies and procedures. Exceptions could mean defining the situations in which the regular rules are not applicable - e.g. in case of a disruptive incident (for instance, large earthquake), the physical acces s controls will not be applied.
See also this article: What should you write in your Information Security Policy according to ISO 27001? https://advisera.com/27001academy/blog/2016/05/30/what-should-you-write-in-your-information-security-policy-according-to-iso-27001/
This online course will help you learn about writing information security policies and procedures: ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Shortest time necessary before applying for ISO 27001 certification
Answer:
This timing is different from one certification body to another - some certification bodies allow you to go for the certification after you finish the internal audit, management review, and close most of your corrective actions; other require a 3 months period of ISMS operation before you can start the certification process.
So the point is - you should ask for quotes from couple of certification bodies, and ask them to specify their requirements.
These articles will help you:
- Becoming ISO 27001 certified – How to prepare for certification audit https://advisera.com/27001academy/iso-27001-certification/
- Infographic: The brain of an ISO auditor – What to expect at a certification audit https://advisera.com/27001academy/blog/2015/06/22/infographic-the-brain-of-an-iso-auditor-what-to-expect-at-a-certification-audit/
- How to choose a certification body https://advisera.com/blog/2021/01/11/how-to-choose-an-iso-certification-body/ -
Referring to the Business continuity policy from the ISMS documentation
Answer:
Business continuity is required in the Annex A of ISO 27001, section A.17 - so if you select those business continuity controls as applicable in your Statement of Applicability, then yes - you should refer to your Business continuity policy in your ISMS documentation.
If the ISO 27001 certification auditor sees that you have implemented business continuity in a proper way, he will certainly look at that fact in a positive way - he will assess your business continuity documentation, and how you performed your exercising and testing, but he probably won't go any deeper.
These articles will help you:
- The importance of Statement of Applicability for ISO 27001 https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/
- How to use ISO 22301 for the implementation of business continuity in ISO 27001 https://advisera.com/27001academy/blog/2015/06/15/how-to-use-iso-22301-for-the-implementation-of-business-continuity-in-iso-27001/
- Which questions will the ISO 27001 certification auditor ask? https://advisera.com/27001academy/blog/2015/07/20/which-questions-will-the-iso-27001-certification-auditor-ask/