ISO FAQ
A free resource for Organization's preparing for ISO Certification
The new Enable ISO Statement of Applicability (SoA): A Brief Overview
To meet the needs of our customers we have prepared a new Statement of Applicability (SoA) spreadsheet, which can be used to prepare for the transition to the latest criteria.
This short video clip looks at the FDIS of ISO 27002 to identify the source of the criteria for the newly developed Enable ISO SoA spreadsheet system, and how our customers can use it to prepare for their organization's transition to the new edition of ISO 27001, once revised to incorporate the new structure of ISO 27002.
Pleace click on the link above to learn more about the Enable ISO SoA.
Making the changes to meet the new requirements of ISO 27002
For organizations who are new to the ISO Standards for Information & Privacy Security Management, and those who are already familiar, and registered to ISO 27001:2013, we offer our proven Information & Privacy Security Gap Analysis service.
Contact us to request a Free 60 Minute Consultation to discuss the scope of an ISO 27002 Information Security, Cybersecurity & Privacy Protection Gap Analysis for your organization.
This gap analysis is delivered by our experienced Consultant Lead Auditors, with a proven track record in helping organizations achieve ISO 27001 Certifications.
For comprehensive information on this important service, please go to our ISO 27002:2021 Gap Analysis page.
4.1 Understanding the Organization and its Context
Internal & External Context
4.2 Understanding the Needs & Expectations of Interested Parties
Identification of Interested Parties
As per ISO 9001 relevant to information security, and
(4.2) The interested parties that are relevant to the PIMS
Legal & Regulatory Requirements
A.5 Information Security Policies A.5.1 Management direction for information security
A.6 Organization of Information Security A.6.1 Internal Organization A.6.2 Mobile Devices & Teleworking
Process Analysis:
We introduce the Process Risk Register, which is the mechanism used to document core operational and support processes.
These core processes are identified so that the nominated management representatives can consider the high level operational activities which need to be considered from an internal auditors perspective.
We look at how the Process Risk Register is used to document these processes in linear sequential order.
Data Protection:
We introduce the Statement of Applicability (SoA) which documents the organization-wide information and privacy security controls. At this point, we consider the structure of the SoA, its purpose, and in particular; that it must contain a description of the control agent, or a significant justification for its exclusion, where determined not applicable.
We also briefly look at the mechanism within the SoA for determining the evaluation frequency or information and privacy security controls, to assure us of their continual suitability and effectiveness.
Documenting issues and concerns which may potentially negatively impact the organization, considering all aspects within the scope of the engagement so far.
Identifying relevant interested parties that are important to the organization, and considering related issues and risks.
The operating environment relevant to EOHS needs to be considered to establish those issues which need to documented formally so that we can prepare for risk assessments through future sessions. All organizations will have compliance obligations toward their interested parties relevant to EOHS.
The management team take away action points to begin documenting the operational and support processes under their responsibility, to describe the associated activities and their expected outcomes.
High level policies for information and privacy security are introduced in month 1.
The management team will need to set aside some time to review these documents so that they can be discussed in detail in month 2.
Also, as part of this months analysis, we look at the requirement for information security responsibilities to be "defined and allocated".
How the organization provides for mobile devices and teleworking is considered in month 1. This is a very important aspect for those organizations who rely heavily on remote working.
Relevant policies are to be approved for use and included in the SoA.
5.1 Leadership & Commitment 5.1.1 Responsibilities toward the Management System 5.1.2 Customer Focus - Compliance, Risk & Customer Satisfaction
5.2 Company Policies 5.2.1 Established Policies 5.2.2 Communication of Policies
As per ISO 9001 relevant to information security.
A.8 Asset Management A.8.1 Responsibility for Assets A.8.2 Information Classification A.8.3 Media Handling
Process Analysis:
Determining the key activities within processes where specific performance indicators are identified.
At this point, we begin to consider what could potentially prevent the process from achieving its expected outcomes.
Using the Process Risk Register to determine the potential issues which may negatively impact our processes, we are now making progress toward effective risk management.
Data Protection:
We look at the technical controls established to prevent negative impacts, and what information needs to be provided through the Process Risk Register.
Asset management is considered in detail. At this stage, we are establishing what has to be controlled, how, and by whom.
The requirement for an inventory of assets is considered, with further consideration for centralized management of these assets.
Media handling. particularly the disposal of hard and soft copy data, hard drives, etc., and the transfer of physical media is considered in detail.
Clause 5.1 of all ISO Standards addresses aspects of leadership which cannot be delegated beyond the management team. Primarily, management is asked to consider its commitment to the management system, delegating responsibilities and authorities, accordingly.
Our high level Quality Policy and Information & Privacy Security Policy are looked at in brief during our remote working sessions. Management is asked to review and approve these documents for inclusion in the TMS at this point. The organization will be required to make these policies available to all relevant personnel and interested parties, internal and external.
Note: These policies have an important function in formal tendering markets.
Typically, most organizations will have some clarity around responsibilities for information assets, as a starting point. Here, we focus on documenting the key aspects of asset management which need to be included in the SoA.
Information classification is carried out on our Data Inventory Register, which will need to be completed to document all of the data being captured by the organization for processing and storage.
How the organization provides for the management of media, including removable media, need to be controlled to the extent necessary to be assured of adequate data protection.
4.3 Determining the scope of the management system
4.4 The Management System and its Processes
4.4.1 PDCA Management System
4.4.2 Management System Documentation
As per ISO 9001 relevant to information security.
A.7 Human Resource Security A.7.1 Prior to Employment A.7.2 During Employment A.7.3 Termination & Change of Employment
Process Analysis:
Operational and support processes are evaluated to establish the responsibilities and interdependencies associated with each high level activity. Where appropriate, relevant authorities associated with process activities need to be considered at this point.
We introduce the General Audit Template, looking at how we tailor it to meet the audit objectives of each core process, the scoring mechanism, and begin our consideration for auditing processes to meet the expectations of a certification auditor.
Data Protection:
We identify the information assets being processed at each stage, establishing the lifecycle of the data through each core operational and support process. (Dataflow).
The requirements for formal personnel management policies relevant to information and privacy security are evaluated to determine organizational controls on people joining and leaving the organization. The controls necessary for managing information security aspects relevant to personnel who are changing roles within the organization are also considered.
From an operational perspective, the focus needs to be on documenting each core operational and support process, to the extent necessary, to provide the reader with enough information for them to understand what is expected of them when carrying out their process activities.
When considering information and privacy security, the team will be identifying the potential negative impacts upon the data within their processes. These impacts are to be categorized as to their effect upon Confidentiality, Integrity and Availability.
With regard to personnel management, the organization needs to formalize its approach to governing what happens when people are occupying and leaving roles with access to information systems.
Policies are provided in generic format within the SoA for consideration.
Management is asked to edit these policies to meet their own needs and approve for use, accordingly.
6.1 Actions to address Risks & Opportunities 6.1.1 General 6.1.2 Planning for Risks & Opportunities
As per ISO 9001 relevant to information security, and
6.1.2 Information Security Risk Assessment 6.1.3 Information Security Risk Treatment
A.11 Physical & Environmental Security A.11.1 Secure areas A.11.2 Equipment
Process Analysis:
With our internal audit function beginning to deliver some audit results, we are making progress, this month including considerations for risk management. The obvious moment for us to test our assumptions with regard to risk management effectiveness, is when we are carrying out our internal audits.
We look closely at a couple of key processes to consider our approach to risk management through internal auditing, taking some examples through full analysis on the Process Risk Register.
At this time, we being to think about the what if's? What if our risk treatments fail? We use the Contextual Issues Register and the Process Risk Register to document our initial considerations for incident response and business continuity management.
Data Protection:
With our focus on risk management across both ISO 9001 and ISO 27001, we continue this month with the introduction of the Enable ISO SoA Monthly Audit Template.
This audit tool is used to carry out monthly hygiene checks on the established information and privacy security controls to ensure that they remain suitable and effective. We look at the structure of the template, which includes the controls we have looked at on the SoA to-date, where we have determined that a monthly evaluation frequency is required to maintain effective control.
Our considerations for risk management now focuses on risk treatments. Actions to address risks and opportunities determined earlier at Clause 4.1 (and 4.2) are now considered, so that we can determine the risk mitigations necessary to prevent potential negative impacts.
It is important to note that some of these contextual issues ,ay have a direct influence on our thinking when considering operation of processes and what needs to be documented on the process risk register with regard to process instruction.
We refer back to the Organizational Risk & Business Continuity Policy, which was introduced earlier in the project, to review its references to risk assessment and risk treatment criteria.
At this stage, we also take a look at physical and environmental security. Keep in mind that remote working organizations are not excused from the criteria: In fact, organizational requirements for physical and environmental security considerations may increase when determining the controls necessary for effective data protection.
Personnel responsible for managing information systems will be taking on some internal audit inspections to inform the internal audit function. This aspect will be discussed in detail to ensure that the applied internal audit control is effective to meet the expected certification audit requirements.
6.2 Management System Objectives & Planning
6.3 Planning of changes
As per ISO 9001 relevant to information security.
A.12 Operations Security A.12.1 Operational Procedures & Responsibilities A.12.2 Protection from Malware A.12.3 Backup A.12.4 Logging & Monitoring A.12.5 Control of Operational Software A.12.6 Technical Vulnerability Management A.12.7 Information Systems Audit Considerations
Process Analysis:
The Internal Audit Programme being developed month by month should now be at a stage where the results of internal auditing should be providing some value.
Importantly, when considering risks and opportunities, including organizational objectives, we look at the internal audit function in how it evaluates our risk mitigations and treatments, organizational objectives for improvement and change, etc.
Data Protection:
Our monthly look at inspections and testing of the SoA controls through the SoA Monthly Audit function should also be delivering results. This is a hygiene check, akin to checking the oil and water in your car engine, and should not be onerous.
The levels of inspections and testing carried out by an organization should be directly proportionate to the criticality and complexity of the organization and its information processing systems.
Much of the work done to carry out inspections of SoA controls is by accessing activity logs, reporting mechanisms, including reports from external service providers relevant to information systems.
Organizational objectives with regard to quality and information security are to be documented on the Enable ISO Objectives Register. It is important to note that established objectives must be measurable, as in, they should be achievable, and can be actioned and completed.
Change management also featured in our analysis this month. Our approach to change management is that significant changes are treated as processes, and documented on the Process Risk Register, where appropriate.
We ask the management team to consider the changes that require formal planning, so that they can be managed through the TMS.
7.1 Resources
As per ISO 9001 relevant to information security.
A.13 Communications Security A.13.1 Network Security Management A.13.2 Information Transfer
Process Analysis:
We evaluate the IAP Schedule. This spreadsheet is used to plan our internal audit programme, with full consideration for the criticality and complexity of the processes.
Process auditing should be developing to a stage where we are now in a position to consider the results of audits as inputs into management review. What are the metrics that have a decision making value?
Data Protection:
Communications security, from an operational perspective, can be a straightforward consideration, with most organizations having good security controls in place for the management of internal and external communications. Here we need to be a little more formal, particularly with regard to any external entity.
The frequency of inspections and evaluations relating to network security and data transfer is considered as we look again at the SoA Monthly Audit Template.
Our SoA development considers network security controls, and network services.
All aspects of internal and external data transfers are evaluated to consider organizational requirements for formal non-disclosure and confidentiality agreements.
We look at IT services from external providers, including web and power suppliers, to identify areas that need to be monitored through the internal audit functions.
Through the ISO 9001 lens, we consider the resourcing of operations, and the TMS, to provide for effective operations. Organizational requirements for buildings, supporting utilities and services are evaluated to evaluate how we are going to document our response to the criteria of the Standard.
To this effect, we introduce the Resourcing Register, which employs the 5 M's:
Manpower;
Materials;
Machinery;
Methodology, and;
Mother Nature (Environmental).
While there is no direct requirement for us to document this aspect in such a manner, it is a useful exercise, as it allows us to formalize the high level resource requirements for operational and support processes, and systems where appropriate. The feedback from certification auditors is also very positive, which can't be a bad thing.
From an ISO 27001 perspective, we are working through very technical criteria, which is typically the domain of IT professionals, usually with a technical competency.
In many cases, it is at this stage that may be working directly with outsourced IT Services providers, where applicable.
The development of the SoA should be well underway, with this months focus being on network security and data transfer. Typically, we find that out customers provisions are more than adequate in this regard, with the main action points relating to the need to document the relevant controls, formally.
7.2 Competence
7.3 Awareness
7.4 Communication
7.5 Documented Information
As per ISO 9001 relevant to information security.
A.14 System Acquisition, Development & Maintenance A.14.1 Security Requirements of Information Systems A.14.2 Security in Development & Support Processes A.14.3 Test Data
Process Analysis:
At this stage of the TMS Project, internal auditing of operational and support processes in well established, with regular auditing taking place.
Our experience is that it is at this stage that our customers use this section of the project to soundboard their own findings with their assigned consultant, taking into consideration the level of detail in their audit reports, how they are documenting their findings, and how they are treating identified nonconformities and corrective actions.
Our objective is to make sure that we are capturing all of the primary elements of each process for consideration relevant to operational effectiveness, information security and other aspects relevant to risk management, objectives for improvement, etc.
Data Protection:
The technical controls required for information systems acquisition are considered. Your certification auditor will expect a forma approach is taken to determining the security requirements for new systems, equipment, especially when relying on external service providers to fulfill organizational requirements.
The organization is also expected to consider this aspect when making changes and upgrades to information systems.
Application service transactions, particularly relevant to organizations with ecommerce platforms, are to be considered for the controls necessary to prevent unauthorized access and potential tampering of the transactional information.
Organizations who develop and maintain their own software applications, whether it is their primary service offering, or in support of their core business, will need to provide a formal approach to their software engineering operations. The expectation is that there will be an established set of criteria, or code of practice, in place to govern this aspect of the organization.
The testing and deployment of software applications is also considered at this time. This aspect is relevant to all organizations who use software applications to support their operations, whether they are a software engineering operation or not. Consider changes to software applications, transitions to new applications, etc., and the potential negative impact should something go wrong.
The competency requirements of the organization are to be documented, using the Role Definitions Register, introduced earlier in the TMS Project. Academic qualifications, training and experience are just some of the considerations which need to be established for each identified role.
Note that there are a number of professionally protected terms, such as; Engineer, Architect, Accounting Technician, Project Manager, and more, which your certification auditor will expect are formally validated to ensure the authenticity of the qualification. This also extends to personnel in key roles, regardless of the qualification.
Management needs also to consider the requirements for making personnel and other relevant interested parties aware of the established policies and controls for both quality and information security. Enable ISO provides its customers with an Induction Training Presentation, which we can deliver through a remote working session, where necessary.
Communications also needs to be considered. While we have addressed some of the technical aspects for information security controls, the organization now needs to establish its own requirements for formal communications, from establishing the requirements of products and services, communicating with its interested parties, etc.
We also encourage our customer organizations to consider their own requirements for media communications planning. Think about it! Is your organization likely to face media attention following a breach of your customer data?
Documented information is also to be addressed with a formal approach to the management of the creating and updating of TMS documents to be established.
Document control features in our analysis this month. We look closely at organizational requirements to ensure that we have appropriate levels of formality in this regard.
8.1 Operational Planning & Control
8.2 Requirements for Products & Services
8.3 Design and development of products and services
8.4 Control of Externally Provided Processes, Products & Services
As per ISO 9001 relevant to information security, and
(8.2) Information Security Risk Assessment
(8.3) Information Security Risk Treatment
A.15 Supplier Relationships A.15.1 Information Security & Supplier Relationships A 15.2 Supplier Service Delivery Management
Process Analysis:
Our Internal Audit Programme is now well developed, with all operational and support processes within the scope of the TMS being audited. At this point we turn our attention to analysis of the trends emerging through the IAP functions. The results of repeated audits, progress made on identified nonconformities, etc.
Your certification auditor will expect that there is effective prioritization of activities relating to corrective actions. The CAR Register is reviewed to ensure that the rationale behind these corrective actions is documented appropriately.
Data Protection:
Similarly, the audit expectations for monthly SoA control checks and inspections are that the organization is regularly checking "under the hood" rather that waiting for a "red light on the dashboard"...
We look at the results of these inspections from an auditors perspective to ensure that we are making good progress.
We also use the IAP section of the project to look at our obligations for information security risk assessments and risk treatments. The Process Risk Register is used to document the relevant risks associated with process and systems activities. We review the risk management provisions to ensure that the information documented is relevant and suitable for use.
Supplier relationships are also featured this month within the context of the IAP. We look at the generic External Provider Evaluation Template which we provide for consideration. The organization will use this as a guide to preparing its own audit templates for inclusion in the TMS.
Audit expectations are that an organization will ensure that the level of control exercised in the management of external providers will be directly proportional to the level of involvement of that provider in operations and the delivery of products and services.
At this point of our analysis of both Standards, ISO 9001 & ISO 27001, we come to a distinct divide in the direction of their considerations.
For ISO 9001 management needs to consider how it established the requirements for the delivery of its products and services. We can use the Resourcing Register, which we introduced earlier to document the high level resources required for effective operations. The purpose of this set of criteria is to ensure that the organization is fully prepared to carry out its process activities, with all of the required process inputs available: The 5 M's.
For organizations where design and development are core, the design lifecycle provided in the ISO 9001 Standard at Clause 8.3 is comparable with most established methodologies. The management team are asked to consider their own disposition with regard to this criteria to establish its own response.
Control of external providers comes into focus this month. This is a critical aspect relevant to all ISO Standards, particularly where an organization relies on subcontractors for the delivery of its products an services. Attention should be on the inputs into processes, to ensure appropriate levels of control are established, and how external providers are to be managed where they are involved on the delivery side of the business.
Complimentarily, we are looking at supplier relationships through the lens of information security at this stage. Your certification auditor will expect a very formal relationship with critical service providers, where data transfer and data processing is important.
To what level an organization needs to manage service providers relevant to information security is an important consideration in EU-GDPR. Management will need to consider the application of the recommended Standard Contractual Clauses, or "Model Clauses", published by the EU Commission for this purpose.
Organizations who work with external providers outside of the EU will need to consider this aspect carefully.
8.5 Production & Service Provision
8.6 Release of Products & Services
8.7 Control of Nonconforming Process Outputs
As per ISO 9001 relevant to information security.
A.16 Information Security Incident Management A.16.1 Management of Information Security Incidents & Improvements
Process Analysis:
With the IAP delivering regularly on its process auditing, we consider the criteria of this months ISO 9001 Clauses 8.5, 8.6 and 8.7, to ensure that we are evaluating established metrics within the audit function.
We want to make sure that the internal auditing is capturing the effectiveness of monitoring and measurement mechanisms, reporting functions, training, and the effectiveness of risk treatments and other controls applicable to operations.
The IAP function should also include consideration for the established acceptance criteria for delivery of products and services, throughout operations.
Data Protection:
Continuing the development of the SOA, this month we are considering the organizations provisions for incident management, relevant to information security.
For most organizations, they rely heavily on being able to react to live reporting of incidents, particularly with regard to phishing, malware and other cybersecurity threats.
From an internal auditors perspective, we need to ensure that appropriate levels of planning are documented for those risks which may have an impact on information systems. Regular testing of incident response plans is considered at this point, to establish a dynamic between the technical team and those carrying out the internal audits.
For example: It may be that the auditor will want to verify effective control of restore from backup, once per calendar month. However, the technical team may well be carrying out this function at numerous points to meet organizational and customer objectives. The audit moment is to provide for a consideration of whether the established control is working for the organization, to demonstrate best practice in this regard.
Scope of Work
Monitoring of operations features strongly this month, with a focus on delivering products and services with the appropriate levels of monitoring and measurement, reporting, and ongoing analysis and evaluation to ensure effectiveness.
Management needs to consider their own requirement for documenting acceptance criteria for products and services delivery to ensure that customer and organizational objectives are met.
Note that measurement traceability is important for organizations who require formal calibration of equipment for the effective management of processes. This is an important aspect, and must meet the requirements of National legislation in this regard.
Controlling nonconformities is also important at this point. Your certification auditor will expect that the organization has a formal approach to identifying, segregating and treating nonconforming products an services, to ensure that they are not used without corrective action. Where appropriate, your auditor may spend additional time on this aspect where it is an important consideration for the organization.
With regard to information and privacy security, management needs to consider how it is to prepare for audit to demonstrate that it tests its incident response controls, failovers, etc., to ensure that it is prepared for all determined potential risk impacts, to appropriate extents.
9.1 Monitoring, Measurement, Analysis & Evaluation
9.2 Internal Audit
9.3 Management Review
As per ISO 9001 relevant to information security.
A.17 Information Security Aspects of Business Continuity Management A.17.1 Information security continuity A.17.2 Redundancies
Process Analysis:
The results of out IAP functions and activities are to be considered in detail this month to ensure that the reporting is providing valuable input into the management review meetings.
Your certification auditor will expect that the reporting data from operations, along with the results of the internal audits, are adequately providing for "evidence based decision making".
Data Protection:
Having considered incident response through the sessions last month, we now look at organizational requirements for business continuity planning.
The analogy is that it is one thing to prepare for putting out the fire. But what does the organization need to do to continue its data processing operations during and subsequent to an incident?
Here we look a little closer at organizational provisions in this regard to ensure that your certification auditor's expectations are adequately met. Redundancy provisions relevant to business continuity are also considered at this time.
Once we have established the data reporting from operations, our ISO 9001 considerations now look to the analysis and evaluation of process data with regard to management reporting. Responsibilities for analysis and evaluation are determined, with consideration business and customer objectives, nonconforming product, etc.
This month we also need to look at completing the IAP Schedule planning for the full 12 month cycle of internal auditing that is to take place subsequent to the certification audit.
Having spent some time evaluating the criteria of Clause 9.1.2 of ISO 9001, Inputs into management review, management is asked to use the Management Review Form provided to formally document their meeting, making sure that all TMS aspects are considered according to the fixed agenda within the structured template.
Of course, let's not forget information security considerations at management review. Our SoA Monthly Audits provide important inputs into this function, with regard to the effectiveness of the established protocols. It is important that the results of these monthly inspections are also considered from a business continuity perspective.
10.1 General
10.2 Nonconformity & Corrective Action
10.3 Continual Improvement
As per ISO 9001 relevant to information security.
A.18 Compliance A.18.1 Compliance with Legal & Contractual Requirements A.18.2 Information Security Reviews
Process Analysis:
Now we consider the "Act" part of the "Plan, Do, Check, Act" lifecycle of the Standards.
How he organization implements changes based on the decisions made at management review is evaluated to ensure that the organization can demonstrate that it treats this aspect formally, and to good effect.
The prioritization of actions arising from the management review meetings are important, as your certification auditor will expect that the organization considers all aspects, including contextual issues, the requirements of interested parties, organizational objectives, compliance obligations etc., when deciding where to commit its resources in this regard.
Data Protection:
The function of internal auditing relative to evaluating the organizations performance toward compliance with legislative and contractual requirements is considered this month. Your certification auditor will expect that this aspect is regularly evaluated through the IAP functions.
An independent review of the SoA controls is a mandatory requirement when presenting for audit to ISO 27001. Enable ISO monthly reporting, while incremental, amounts to an overall review of the entirety of the SoA. We review these reports to ensure that all critical controls have been evaluated, and that the resulting action points are adequately documented and closed out according to effective prioritization.
This month, to compliment our analysis of Clause 10 of both ISO 9001 and ISO 27001, we look at the results from the management review meetings and how they are addressed within the TMS.
The organization needs to ensure that appropriate actions are drawn from their management meetings, whether they are relating to nonconformities or indeed, improvements.
The established CAR & Objectives Registers are to be used to document these actions accordingly, with regular reviewing being carried out to ensure good progress is being made.
Our information and privacy security considerations are this month focusing on compliance obligations, with regard to both contractual and legislative requirements. In particular, there is the consideration for EU-GDPR and its requirements for formality around organizational practices in this regard.
We also look at the mandatory requirement for an independent review of the SoA controls to ensure objectivity with regard to their application and effectiveness.
This edition of ISO 27002 establishes the criteria for best practice in the management of Information Security, Cybersecurity & Privacy Protection, relevant to both ISO 27001 and EU-GDPR. The controls required to meet the requirements of this Standard correlate comprehensively with the legislative requirements of EU-GDPR, for appropriate technical and organizational measures, organization-wide.
For a brief introduction to this Standard an the Enable ISO Statement of Applicability (SoA), please click on the following link.
Introduction
Subsequent to our initial Scope Meeting, where we discuss the scope of the gap analysis relevant to the organization, we open our Gap Analysis engagements with 3 sessions.
Where the organization has prepared a Statement of Appicability (SoA), the initial evaluation is required so that the assigned Consultant Lead Auditor can assess the disposition of the organization relevant to the requirements of the Standard and EU-GDPR.
For organizations who are beginning their ISO journey, we amalgamate the time allocated for the initial evaluation with the Opening Session, so that the relevant aspects can be discussed to plan for an effective gap analysis.
Initial Offline Evaluation
This initial engagement includes a high level review of the organizations Statement of Applicability (SoA) along with relevant policies and records to support their compliance obligations toward information security.
This evaluation is carried out by the assigned Consultant Lead Auditor, who will then lead the gap analysis through to completion.
Time allocation: 60-90 minutes, depening on the organization.
Opening Session
A meeting to introduce the audit methodology and prepare for the scheduled sessions.
This meeting also provides an opportunity to discuss relevant Contextual Issues, including those associated with the requirements of Interested Parties.
At this stage of the analysis, stategic interests need to be considered, where they may have a portential impact on the organization's ability to effectively manage information security.
Time allocation: 60-90 minutes, depening on the organization.
Offline Internal Evaluation
Organizational documentation is evaluated by the auditor to determine requirements for evaluation throughout the engagement.
The assigned Consultant Lead Auditor will use the learnings from this evaluation to effectively prepare for the scheduled gap analysis sessions to follow.
Time allocation: 120-240 minutes, depening on the organization.
Each session looks at a number of subclauses of ISO 27002:2021, grouped by topical aspect and function. This element of the gap analysis evaluates the organizations disposition toward organizational controls required for effective information and privacy security management.
There are 6 remote sessions to be arranged of varying durations. Each session may require the participation of different management representatives, dependent on their responsibilities toward information security relevant to the analysis criteria.
Part 1: Management Responsibilities
A meeting with the leadership team to evaluate the organization's position with regard to policy requirements, management responsibilities, and how internal and external contextual issues relevant to information security are identified to inform threat intelligence.
In addition, governance with regard to project management, regardless of the type of project, is considered, where relevant to the organization.
It is expected that the nominated management representatives participating in this session will have a good understanding of how the organization currently manages these aspects.
It may be necessary for an appointed DPO to be present, where applicable.
Time allocation: 60-90 minutes, depending on the organization
Part 2: Information Asset Management & Access Control
A review of how the organization provides for inventories of systems, applications and data assets.
This session looks closely at asset classification relevant to EU-GDPR. Appropriate labelling of information assets to meet organizational requirements is also considered.
Access to information and systems is evaluated against the criteria to determine the effectiveness of current measures.
The minimum expectation is for the principle of least privilege to be the governing rule of thumb.
To achieve the best outcomes from this session, the management representatives for IT systems and Access Control need to participate.
This may require engaging with external providers as applicable to the organization.
Time allocation: 60-90 minutes, depending on the organization
Part 3: Supply Chain Security
This session addresses supplier relationships, where external providers may have an impact on information security.
Contractual arrangements come under review to determine the effectiveness of current controls and identify areas for improvement, where applicable.
The Standard Contractual Clauses or "Model Clauses", as promoted by EU-GDPR, are used as a benchmark relevant to organizational requirements.
Importantly, the management representatives responsible for managing supplier relationships need to be available to participate in this session for effective progress to be made.
Time allocation: 60-90 minutes, depending on the organization
Part 4: Incident Response
How the organization determines its incident response activities, resources and planning requirements comes under evaluation in this session.
The focus is on maintaining the confidentiality, integrity and availability of the data being processed.
This session can benefit from the participation of relevant team leaders and department heads, where they are responsible for significant data processing activities, or where there may be areas of concern relevant to incident response.
Time allocation: 45-60 minutes, depending on the organization
Part 5: Business Continuity
The primary focus of this session is to evaluate how the organization provides for business continuity management during a disruptive event.
How specific categories of events are assessed for business continuity requirements, through to testing the abilities of the organization to deliver to those needs, comes into consideration.
As with incident management, relevant personnel need to participate to achieve the best results.
Time allocation: 45-60 minutes, depending on the organization
Part 6: Compliance
Relevant to EU-GDPR and other applicable data protection legislation, the requirements of the organization are considered to determine the effectiveness of the provisions in this regard.
Where applicable, Intellectual Property management is discussed to determine relevant controls.
Internal audit functions, including technical and code reviews, where applicable, are considered.
The importance of an independent review of technical and organizational measures is discussed. (The gap analysis provides for this requirement relevant to ISO 27001 Certification).
Management representatives for compliance, data governance, IT security, etc., need to participate to achieve best outcomes.
It may be necessary for the appointed DPO to be available, where applicable.
Time allocation: 60-90 minutes, depending on the organization
The importance of appropriate organizational controls relevant to people or personnel management cannot be underestimated. Our analysis of people controls for ISO 27002:2021 considers organizational requirements for contractual arrangements, including non-disclosure, responsibilities toward the reporting of information security issues and concerns, responsibilities for information assets, etc.
People controls are evaluated through 2 remote sessions, with participation from the relevant management representatives.
Part 1: People 1
Employee contractual arrangements, training, and internal reporting and disciplinary procedures are reviewed as part of this session.
Provisions for ongoing awareness of information security policies and controls are evaluated.
Changes to terms of employment, changing roles, etc., are also considered.
Participation is required by management representatives who have authority and access to relevant documents and records, for effective progress to be made.
Time allocation: 45-75 minutes, depending on the organization
Part 2: People 2
The terms of non-disclosure relevant to organizational requirements are assessed to determine the effectiveness of established controls.
Also, the significance of information security relevant to remote working is considered to ensure appropriate controls are in place.
Importantly, formal mechanisms for the reporting of information security issues and concerns are assessed for effectiveness.
Management representatives with a full understanding of the data processing requirements of operations, need to participate in this session for good progress to be made.
Time allocation: 30-45 minutes, depending on the organization
Physical and environmental security controls are critical to the information security requirements of any organizatiion. For ISO 27002:2021, the physical controls are provided for through a number of subclauses, which we address in 3 remote sessions.
Video footage of walk-abouts at relevant locations, demonstrating good practice in areas such as perimeter security and access to premises, protection of controlled processing areas, segregated work areas, common areas, etc., can be used to support the gap analysis. In some circumstances, it may be necessary to arrange a location visit to validate specific requirements.
Part 1: Physical Security Controls
In this session we look closely at the physical security requirements for data processing facilities and workplaces.
Perimeter and internal security, protected work areas, document storage, server and comm's rooms, all come under consideration, where applicable.
Monitoring and inspections to evaluate and maintain the effectiveness of physical security controls are also considered at this stage.
To achieve the best results, management representatives with responsibilities for physical security are required to participate.
This may require some input from those with leadership responsibilities in operations, admin, and other organizational functions, as applicable.
Time allocation: 45-60 minuts, depending on the organization
Part 2: Secure Operations
Resourcing information security in operations and data processing is the main consideration for this session.
At this stage, we evaluate the effectiveness of established controls for continued suitability and effectiveness.
Siting of equipment, clear desk and clear screen controls are considered, where appropriate.
Where the organization processes or stores data at off-site or at secondary locations, information security controls are considered relevant to the needs of the organization.
Management representatives with responsibilities toward physical security, IT security and operations will be required to provide input into this session in order to achieve best outcomes.
Time allocation: 30-60 minutes, depending on the organization
Part 3: Media & Equipment Security
In this session, we evaluate the effectiveness of established information security controls for the management of data storage and repositories, cabling and routing, and the provision of utilities and other critical services necessary for effective operations.
In addition, we evaluate how the organization maintains and disposes of information assets at end-of-life or through planned purges, etc.
To achieve the best results, participation is required from management representatives with responsibilities for maintaining information systems, and the subsequent disposal of information assets, whether data or physical assets.
Time allocation: 45-60 minutes, depending on the organization
A total of 8 remote sessions are required to cover the criteria of this section of the ISO 27002:2021 Standard, which addresses the criteria for the technical measures required for the organization, relevant to both the Standard and EU-GDPR.
For each session, management representatives responsible for IT systems, access and control, are required to participate. External providers with responsibilities toward these aspects may also need to participate to achieve best outcomes.
Part 1: Endpoint Security
Reference: Information Asset Management & Access Control (Above)
In this session we review the established controls over information assets, relevant to the classification scheme adopted by the organization, and other considerations determined when we looked at Organization Controls for asset management and access control.
Allocated time: 45-60 minutes, depending on the organization
Part 2: Systems Security
Information systems protection is considered through this session, with a focus on critical controls including malware protection.
How the organization resources the monitoring of technical vulnerabilities is evaluated for suitability and effectiveness.
Allocated time: 45-60 minutes, depending on the organization
Part 3: Secure Data Management
This session looks at the specific requirements of the organization for how data is to be protected when stored and processed on relevant information systems.
Data masking, leak protection, backup and restore functions are all considered relevant to the nature of the processing.
Allocated time: 45-60 minutes, depending on the organization
Part 4: Logging & Monitoring
Systematic monitoring and logging is considered to evaluate organizational requirements and to ensure that appropriate levels of controls are established.
Clock synchronization is an important aspect, which is also addressed.
How the organization provides for the management of utility programmes and software applications is also considered in detail.
Allocated time: 45-60 minutes, depending on the organization
Part 5: Network Security Management
The management of network security is considered at this session. Segregation within networks is an important aspect which is discussed to determine the effectiveness of organizational provisions.
Network transactions are also important with regard to confidentiality, integrity and availability, and are considered relevant to the specific requirements of the organization.
Allocated time: 45-60 minutes, depending on the organization
Part 6: Filtering & Cryptographic Controls
Access to websites and other online platforms needs to be controlled to ensure effective information security management.
Integrity and availability are the control aspects of importance in this regard.
Cryptographic controls are evaluated, particularly where it is within the organization's capacity to enable endpoint encryption.
Encryption is expected to be used where available to the organization as an additional layer of security.
Allocated time: 45-60 minutes, depending on the organization
Part 7: Secure Application Development
For those organizations who carry our software development, or indeed, outsource this type of activity, this session looks at some important requirements of information security controls.
This also applies to systems development, which may not require software development, but can equally impact on the organization's ability to protect information and processing facilities.
Allocated time 60-120 minutes, depending on the organization
Part 8: Secure Test & Change Management
Testing and approval of systems changes and newly developed applications can provide many opportunities for risk to the data being processed.
In this important session, we consider the requirements of the organization with regard to the technical and organizational measures required to effectively provide for its obligations toward ISO 27002 and EU-GDPR.
Allocated time: 45-60 minutes, depending on the organization.
Once the analysis phase is complete, the assigned Consultant Lead Auditor works alone to prepare their report.
Our reporting provides a comprehensive record of all of the criteria discussed throughout the gap analysis sessions, along with professional guidance on the scope of work required to close the identified gaps.
Offline Reporting
Offline reporting documented by the project Lead Information & Privacy Security Auditor.
Allocated time: 240-360 minutes, depending on the organization
Wrap Up Session
A meeting for all participants to discuss and assign action points arising from the Information & Privacy Security Gap Analysis engagements.
Allocated time: 60-90 minutes, depending on the organization
Relevant to:
ISO 9001 & All ISO Management Systems Standards
Answer:
The best definition available is that, the context of the organization is a combination of internal and external issues that can have an effect on an organization's approach to developing and achieving its objectives.
Similar terms to "context of the organization" include:
Business environment;
Organizational environment;
Ecosystem of an organization.
The organizational infrastructure needs to be considered to ensure that the contextual environment is adequately defined.
How the organization carries out its operations will be dependent on; facilities, equipment, utilities, services and more, in order to maintain conformance.
Answered by: Phil Byrne
Relevant to:
ISO 31000 & All ISO Management Systems Standards
Answer:
A typical definition is; the identification of issues and concerns which may impact an organization:
with established criteria for the assessment and treatment of relevant risks, and;
subsequent incident response and business continuity considerations.
In a formally managed organization, a risk register or equivalent will be maintained, using an established risk management methodology or code of practice.
Answered by: Phil Byrne
Relevant to:
ISO 27001 & ISO 27701 Certifications
Conformance to EU-GDPR
Answwer:
The general expectation of most market sectors is that an organization deemed to be conformant with ISO 27001 is demonstrating compliance with the security elements of the data protection acts.
For those organizations who need to include obligations toward EU-GDPR, the extended requirements of ISO 27701:2019 will need to be included within the scope of the certification audit.
Answered by: Phil Byrne
Relevant to:
ISO 28000 & ISO 28001 Certifications
Reference: To support certification to ISO 9001 & All ISO Management Systems Standards
Answer:
In today's business environment, there is a heavy reliance on supply chains, especially given the Global nature of working, with products and serices being sourced from any location.
When providing products and services into critical supply chain sectors, such as; Medical, Pharmaceutical, Automotive, Aerospace, Food Processing, and many more, an organization may be asked to demonstrate good practice in the management of their supply chains, using ISO Certification to ISO 28001 & ISO 28001.
The expectation is that external providers into such critical supply chains will obtain AEO, ISO 2800, or equivalent certifications or approvals, in order to participate in commercial activities.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & All ISO Management Systems Standards
Answer:
ISO is the name adopted by the International Organization for Standardization.
ISO, the word, derives from the Greek word "ISOS", which means EQUAL.
The implication is that organization's who subscribe to ISO Standards, are doing business on an equal playing field.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & All ISO Management Systems Standards
Answer:
From an auditors perspective, this clause is not delegatable by top management. It is for them to be able to demonstrate to an auditor that they have participated in the development and resourcing of the management system, and all of the relevant criteria.
An auditor will typically validate conformance to this criteria through conversation with top management and supervisors, etc, to determine the effectiveness of applied leadership throughout the organization.
Knowledge, awareness, understanding, etc., of organizational policies and controls, contextual issues, etc., will contribute to the supporting evidence.
Answered by: Phil Byrne
Relevant to:
ISO 28001 & ISO 28001 Certifications
Reference: To support certification to ISO 9001 & All ISO Management Systems Standards
Answer:
Organizations who apply for Authorized Economic Operator (AEO) status generall have two fundamental criteria in common:
they are involved in critical supply chains, and;
they carry out customs activities.
It is a given that such organizations will be adequately meeting their obligations under the local Customs Authoroties, and as such, there will be an established relationship between the said authorities and the organization governing operations to good effect.
ISO Standards come into play when considering the operational aspects, with particular regard to how the organization manages its supply chain. The ISO 28000 suite of Standards are applicable to Supply Chain Security. There is a requirement for a "Statement of Application" to support registration to this Standard.
The Statement of Application presents the reader with documented information on the external providers which are significant to the organization, and how identified risks are managed to good effect.
Answered by: Phil Byrne
Relevant to:
ISO 27001 & ISO 27701 Certifications
Answer:
ISO 27001, at clause 6.1.3 requires an organization to:
"... compare the controls determined... with those in Annex A... (and) produce a Statement of Applicability that contains the necessary controls and justification for inclusions; whether they are implemented or not, and the justification for exclusions of controls from Annex A".
The "Annex A" mentioned provides a comprehensive list of controls to provide for the management of information and privacy security, across the organization.
It is important to note that the requirements is that the Statement of Applicability (SoA) "contains" the information to support the organizations disposition with regard to each control.
Answered by: Phil Byrne
Relevant to:
ISO 9001 Certification
Reference: Preventive action
Answer:
The term "risk-based thinking" came into ISO with the introduction of the Annex SL hierarchy. For most, the first itieration of this was with ISO 9001:2015. It was a major talking point at that time, because of the significance of the removal of references to "preventive action", which we had all become so accustomed to.
Risk-based thinking is not stipulated as a requirement in any prescribed manner. At clause 0.3.3 of ISO 9001, there is some guidance in generic terms.
It also states:
"To conform to the requirements of this International Standard, an organization needs to plan and implement actions to address risks and opportunities. Addressing both risks and opportunities establishes a basis for increasing the effectiveness of the quality management system, achieving improved results and preventing negative effects".
So we can now understand the logic of removing references to "preventive action".
It is important to note that the application of risk-based thinking requires some analysis of the issues determined under clauses 4.1 and 4.2 as inputs into the organizations response to clause 6.1; actions to address risks and opportunities. Relevant actions should also inform the organization on its requirements under clause 4.4 to support risk-based thinking through its documentation of process information.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & All ISO Management Systems Standards
Answer:
The International Organization for Standardization is the not-for-profit organization which runs ISO.
The ISO Central Secretariat is based in Geneva, Switzerland. Each "member" nation, including Ireland, participates in the development and upkeep of the ISO suite of Management Systems Standards.
It is important to note that ISO is responsible for the development and publication of the Standards, and is totally independent of the auditing activities required for certification to these Standards. There are multiple levels of authority for the management of certification schemes to ISO Standards criteria.
As described above, ISO is responsible for the development an publication of the Management Systems Standards.
Auditing practices and "Accreditation" is overseen by another Global organization; The International Accreditation Forum (IAF), which has as one of its its primary objectives; to develop and harmonize accreditation practices across the world.
National authorities for the accreditation of Certification Bodies are required to conform to the requirements of the IAF to maintain status in the ISO Global community.
In Ireland, the National authority is the Irish National Accreditation Board (INAB).
In the U.K. it is the United Kingdom Accreditation Services (UKAS).
National authorities for the adoption and management of the relevant ISO Standards must operate under the authority fo the National accredition authority, as described above.
In Ireland, the Natinal Standards Authority of Ireland (NSAI) is the government appointed authority.
In the U.K. it is the British Standards Institute (BSI).
In each country, there are a number of accredited Certification Bodies to choose from when preparing for audit to ISO Standards.
It is important to reference the published list of accredited Certification Bodies on the website of the National Accreditation Authority in your country.
In Ireland, INAB publishes a list of all accredited Certification Bodies under its authority, with full descriptions of the scope of accreditation for each body.
In summary; the question "Who runs ISO? produces a lenghty answer. Let us know if you need a little help, via the chat box to the bottom right of this web-page.
Answered by: Phil Byrne
Relevant to:
ISO 9001 Certification
Reference: Measuring Instruments Directive (EU)
Answer:
For the purposes of audit to ISO 9001, an auditor will expect that the requirements of the customer and the organization are adequately met to meet both contractual requirements and those of legislation, or inductry regulation.
Organization's who operate equipment and machinery which require mandatory independent calibrations should always use a registered or licensed services provider, as applicable.
Good record-keeping is essential for presentation at audit.
Note that there are certain requirements for organization's who issue calibration certificates, particularly with regard to the information published upon them. It is important that an organization understands the specific requirements in each respect, where applicable.
Answered by: Phil Byrne
Relevant to:
ISO 9001 Certification
Answer:
ISO 9001 is an international standard for Quality Management Systems. It is issued to over 1 million organizations globally, in over 170 countries.
The requirements of ISO 9001 are generic in nature, and as a result, it is applicable and scalable to any type of organization, regardless of size or the nature of their activities.
In the formal tendering markets, ISO 9001 represents best practice, and is required for most tendering purposes, particularly those of high value or where an organization is engaging in critical supply chain activities.
Answered by: Phil Byrne
Relevant to:
ISO 9001 Certification
Reference: Risk-based thinking
Answer:
Although clause 6.1 specifies requirements to firstly determine the risks (and opportunities) that need to be addressed, and then plan actions to address those risks, there is no stipulation for how an organization manages this aspect. It goes directly from determining risks, to treating risks.
When we look to the other ISO Management Systems Standards for guidance, they go a little further.
ISO 45001 requires that:
The organization shall assess the risks and opportunities that a relevant to the intended outcome of the OH&S management system, and includes processes and changes to processes;
It further stipulates that in the case of planned changes, whether temporary or permanent, the organization shall assess the risks and opportunities associated with the changes.
ISO 14001 requires that:
Environmental aspects are considered, along with the results of analysis to meet the requirements of clauses 4.1 and 4.2;
It further states that potential emergency situations should be considered.
ISO 27001 requires that:
Information security risk assessments are carried out, with subsequent risk treatments;
There is an important note to close out ISO 27001, clause 6.1 - "The information security risk assessment and risk treatment process in this International Standard, aligns with the principles and generic guidelines provided in ISO 31000".
For ISO 9001 there is NO requirement for a formal method for risk management, or a documented risk management process. Some further consideration is required when preparing for audit to multiple ISO Standards, as one methodology should be made suitable for certification applications.
There are two common-place generic risk management methodologies, which can help an organization analyse risks and opportunities: SWOT & PESTEL. A Google search for these terms will produce a lot of generic results to consider.
Answered by: Phil Byrne
Relevant to:
ISO 27001 & ISO 27701 Certifications
Reference: ISO 29100
Conformance to EU-GDPR
Answer:
Article 6 of the EU-GDPR addresses the requirements for the "Lawfulness of Processing" of Personally Identifiable Information (PII).
At point 1 a) of Article 6, it states that processing can only be lawful where; "the data subject has given consent to the processing of his or her personal data for one or more specific purposes".
There are also numerous references to further articles and recitals which address specific criteria relevant to obtaining consent, particularly with regard to sensitive data.
Clause 5.2 od ISO 29100:2011 addresses this aspect in some detail. Importanty, it states:
Provisions should be made to provide PII principals with the opportunity to choose how their PII is handled and to allow a PII principal to withdraw consent easily and free of charge.
In summary, there are a couple of important points of note:
That the purpose(s) of the data processing must be clearly defined in clear unambiguous language;
That consent for multiple purposes cannot be obtained collectively;
The PII principal, or data subject must be able to withdraw consent, without constraint.
Further criteria applies when considering the nature of the processing and the sensitivity of the PII being processed.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & All ISO Management Systems Standards
Answer:
The criteria of Clause 4.1 of the ISO Management Systems Standards (Annex SL) requires that an organization determines those issues which may impact operations, documenting them formally, and resourcing the monitoring and subsequent review of those issues.
Determining the relevant contextual issues includes consideration for numerous aspects, including compliance obligations.
We recommend that each issue is assigned to a nominated management representative for the purpose of ensuring that the responsibility for monitoring and reporting is assigned.
Regular reviewing of these issues should occur at planned management reviews, with a frequency proportionate to the potential affect on the organization.
Answered by: Phil Byrne
Relevant to:
ISO 31000:2018 Risk Management Guidelines
Answer:
No. This ISO Standard is published as a guidance document for those actively involved in the managing risks through organizations.
ISO 31000 is referenced in other ISO Management Systems Standards, such as ISO 27001, as a framework for best practice.
Answered by: Phil Byrne
Relevant to:
ISO 27001 & ISO 27701 Certifications
Conformance to EU-GDPR
Answer:
Drawn from early guidance published by the Data Protection Commissioner in Ireland; an organization needs to appoint a Data Protection Officer, or have the advice and services of one available to it, unless it can demonstrate that it does not.
In reality, an organization should seek the advice of a competent person to help them to determine whether the appointment of a DPO is necessary. The advice and services option can be adhered to through a formal engagement with an external service provider, such as Enable ISO.
The conclusion is that the only way to avoid any obligation is to have no data!
Answered by: Phil Byrne
Relevent to:
ISO 9001 & All ISO Management Systems Standards
Answer:
Once a risk or opportunity has beed identified, ISO 9001 requires that the organization takes a formal approach to incorporating relevant instruction into processes, where appropriate, and subsequently verifying that the mitigation remains suitable and effective.
Typically, this verification activity is carried out through Internal Audit.
Answered by: Phil Byrne
Relevant to:
ISO 27001 & ISO 27701 Certifications
Conformance to EU-GDPR
Answer:
Derived from the militaristic term "principle of least authority", this is a key principle when applied to information and privacy security, relevant to EU-GDPR.
A basic definition is that; a person should be given access to data for a defined purpose, otherwise; they should be prevented.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & All ISO Management Systems Standards
Answer:
The definition according to ISO 9001 is; the ability to apply knowledge and skills to achieve intended results.
Drawing directly from ISO 9000:2015, Clause 2.2.5.3, it states:
A QMS is most effective when all employees understand and apply the skills, training, education and experience needed to perform their roles and responsibilities.
It is the responsibility of top management to provide opportunities for people to develop these necessary competencies.
Answered by: Phil Byrne
Relevant to:
ISO 27001 & ISO 27701 Certifications
Conformance to EU-GDPR
Answer:
The criteria in Clause 4.1 of ISO 27001 is similar in purpose to ISO 9001, where the requirement is to determine the external and internal issues which may impact the organization: This time, with regard to information and privacy security.
A primary consideration arising from legal aspects relevant to EU-GDPR is for the organization to determine its disposition with regard to its responsibilities toward the data it processes through its operations. The EU-GDPR specific, ISO 27701 Standard, for the management of Personally Identifiable Information (PII), states:
The organization shall determine its role as;
a PII controller (including as a joint PII controller), and/or;
a PII processor.
The organization will also need to state its requirements with regard to the appontment of a Data Protection Officer (DPO).
In addition, it requires an organization to meet the following criteria:
The organization shall determine external and internal factors that are relevant to its context and that affect its ability to achieve the intended outcome(s) of its PIMS (Personal Information Management System).
For example, these can include:
applicable privacy legislation;
applicable regulations;
applicable judicial decisions;
applicable organizational context, governance, policies and procedures;
applicable administrative decisions;
applicable contractual requirements.
The note supporting the criteria in Clause 4.1 of ISO 27001 refers to ISO 31000, which provides guidance on how to determine relevant contextual issues.
Our recommendations are drawn from Clause 5.4.1 of ISO 31000:2018
All organizations will need to consider how they see themselves in their own market, relevant to:
The nature of the work they do;
the categories and sensitivity of data,
the nature of the processing.
The markets they operate in;
location based considerations relevant to culture, socio-economic, regulatory and other considerations,
customer expectations with regard to the management of nformation and privacy security,
methodologies and established codes of practice, where applicable.
Contractual arrangements may produce some considerations for inclusion under the contextual issues clauses.
The relationships with external interested parties may by of a nature where there s a need for;
Data Protection Agreements, and
Nondisclosure Agreements.
Because of the nature of relationships with significant interested parties, an organization may need to establish enhanced controls to govern the management of information and privacy security issues and concerns.
Answered by: Phil Byrne
Relevant to:
ISO 27001 & ISO 27701 Certifications
Conformance to EU-GDPR
Answer:
The short answer is NO!
An organization who is successfully audited to the criteria of ISO 27001 cannot use the certification to demonstrate conformance to EU-GDPR as a direct demonstrable instrument.
However, given that EU-GDPR is a minimum set of legal requirements for the management of Personally Identifiable Information (PII), and that ISO 27001 is internationally accepted as representing best practice in this regard, ISO 27001 registration demonstrates that an organization operated to a higher standard than the minimum legal requirements.
Note that the criteria established in ISO 27001 needs to be supplemented with that of ISO 27701:2019 to ensure that the organization includes all requirements with regard to EU-GDPR obligations.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & All ISO Management Systems Standards
Answer:
ISO requirements, when it comes to environment, are far-reaching: It includes the whole physical environment in which people work - heat, temperature, light, security, physical layout for comfort and the ability to perform functions.
It also includes the social/emotional/well-being aspects of the work environment. Management have responsibility, a duty-of-care, to ensure that all aspects of the work environment for employees is provided, maintained and monitored.
Answered by: Vincent Delaney
Relevant to:
ISO 27001 & ISO 27701 Certifications
Conformance to EU-GDPR
Answer:
The acronym "PII" stands for Personally Identifiable Information. The term itself refers to information by which an individual can be identified.
Answered by: Phil Byrne
Relevant to:
ISO 9001 Certification
Reference: Measuring Instruments Directive (EU)
Answer:
The Measuring Instruments Directive (MID) is the European law that sets down the essential requirements for a wide range of measuring instruments.
It provides options for the manufacturer on how the requirements are to be met and which bodies to apply to for conformity assessment.
The Directive is enacted into Irish law by SI No 2 of 2018- Legal Metrology (European Conformity Assessment of Measuring Instruments) Regulations 2018.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & All ISO Management Systems Standards
Answer:
A basic definition is "a course or principle of action adopted or proposed by an organization or individual".
Relevant to ISO Standards, there are mandatory requirements for organizations to establish policies across various aspects.
In general, an ISO Policy Statement will inform readers that the organization has developed and implemented a formal management system using the subscribed ISO Standards as a framework.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & ISO 27001 Certifications
ISO 27701
Conformance to EU-GDPR
Answer:
Before responding directly to the question, it is important to note that it is the responsibility of all organizations to operating under EU-GDPR to maintain an inventory of personal data, and to categorize that data to determine organizational requirements with regard to data protection.
"Sensitive Personal Data" is personal data, revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership; data concerning health or sex life and sexual orientation; genetic data or biometric data.
In particular, genetic and biometric data are treated explicitly in EU-GDPR, with expectations of elevated or enhanced information and privacy security controls established.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & ISO 27001 Certifications
Conformance to EU-GDPR
Answer:
There is a requirement of both the ISO Standards and of EU-GDPR to document the roles relevant to information and privacy security. Those role definitions should also include a description to the responsibilities toward data protection, and the authorities, associated with each role.
To determine what are the relevant responsibilities, look to the policies and controls that the organization has established to govern information and privacy security through its operations. The organization will have identified and treated risks, and made individuals aware of the residual risks, and what to do in the evant of an incident, etc.
Responsibilities can include:
Adhering to the established policies and controls governing operating activities;
Responding to incidents according to established planning and processes;
Reporting of issues and concerns to a nominated management representative.
In adition, leadership responsibilities can include the supervising of policies and controls to ensure adherance across their areas of responsibility. An auditors expectation is that personnel occupying leadership roles will assume or be assigned, elevated responsibilities toward inormation and privacy security management.
Answered by: Phil Byrne
Relevant to:
ISO 27001 & ISO 27701 Certifications
Conformance to EU-GDPR
Also, for reference: ISO 90003:2018
Answer:
In response, it is important to pint out that ISO 9001 & ISO 27001 both treat this aspect well, as the criteria applies to any organization.
Drawing for ISO 90003:2018, the criteria is supplemented significantly, with guidelines for best practice in software engineering environments.
Software specific internal and external issues can include:
Use of “Cloud” (i.e., network accessed systems provided by a third party) applications, tools and storage services.
An external risk for all software organizations is that of safety, security and assurance of data and systems from external attack by unauthorised access to networks or transfer of malware or viruses to organizations’ computer systems.
The delivery of the softwware as an end product in itselfcan result in issues for an organization.
The legal obligations of software product users may extend to the software engineering organization.
Without getting to know the specific operating environments of individual software engineering organizations, we can only be generic in our response to this question. We remain available to discuss specific aspects with readers. Just ask your question through the chat box, to the bottom right of your screen.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & ISO 27001 Certifications
Conformance to EU-GDPR
Answer:
Some data sets can be changed or amended in such a way that no individuals can be identified from the data by any means or by any person. Ensuring that there is no way in which individuals can be identified can be a technically complex task.
Fully anonymized data is outside of the scope of EU-GDPR and does not apply.
Answered by: Phil Byrne
Relevant to:
ISO 9001 Certification
Reference: ISO 9000:2015 Quality managegement systems - Fundamentals and vocabulary
Answer:
Clause 2 of ISO 9000:2015 provides some very good guidance for organizations on understanding the concepts and principles of quality management. It defines the rationale behind established these quality management principles, including; societal change, technological change, and importantly, globalization of markets and the emergence of knowledge as a principal resource.
The 7 quality management principles are as follows:
Customer focus
The primary focus of quality management is to meet customer requirements and strive to exceed customer expectations.
Leadership
Leaders at all levels establish unity of purpose and direction and create conditions in which people are engaged in achieving the oganization's quality objectives.
Engagement of people
Competent, empowered and engaged people at all levels throughout the organization are essential to enhance the organization’s capability to create and deliver value.
Process approach
Consistent and predictable results are achieved more effectively and efficiently when activities are understood and managed as interrelated processes that function as a coherent system.
Improvement
Successful organizations have an ongoing focus on improvement.
Evidence-based decision making
Decision-making can be a complex process and it always involves some uncertainty. It often involves multiple types and sources of inputs, as well as their interpretation, which can be subjective. It is important to understand cause and effect relationships and potential unintended consequences. Facts, evidence and data analysis lead to greater objectivity and confidence in decision making.
Relationship management
For sustained success, organizations manage their relationships with relevant interested parties, such as providers.
While I have listed these principles in the same order as they are published, it is stressed by ISO that each one is of equal priority, so they can be read in any order.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & ISO 27001 Certifications
Conformance to EU-GDPR
Answer:
Some data sets can be changed or amended to ensure that no individuals can be identified from those data (whether directly or indirectly) without a "key" that allows the data to be re-identified.
A good example of pseudonymous data is the coded data used in medical and clinical trials, where it would be necessary to ensure that the identity of individuals is protected, with a possibility of re-identifying where required.
Pseudonymous data is treated as personal data because it can enable the identification of individuals via a key. However, provided that the "key" that enables re-identification of individuals is kept separate and secure, the risks associated with pseudonymous data are likely to be lower, and so the levels of protection required for that data are likely to be lower.
Pseudonymisation of data can allow an organisation to satisfy its obligations toward "privacy by design" and "privacy by default". EU-GDPR explicitly encourages organisations to consider pseudonymisation as a security measure.
Answered by: Phil Byrne
Relevant to:
ISO 9001 Certification
General obligations
Answer:
The requirements of ISO 9001 for a "Quality Policy" are very specific:
The immediate requirement of Clause 5.2.1 is that top management shall be responsible for the development and implementation of this policy;
Bullet point a) prescribes that; purpose, context and strategic direction are supported by the established policy;
The requirement at point b) is intended to provide for a formal approach to the setting of organizational objectives; relevant to its purpose and strategic direction;
At point c), the organization is required to ensure that there is an explicit commitment to satsfying "applicable" requirements. This, of course, includes the requirements of ISO 9001;
The final bullet point, d); requires that the policy includes a commitment for the organization to continually seek to improve the quality management system.
There are many different opinions on how to go about preparing a quality policy statement. For the pusposes of ISO 9001 certification, we recommend that a high-level approach is taken to include the primary requirements that an ISO auditor will expect, without being tempted to go into too much detail.
It is worthwhile making reference to the 7 Quality Management Principles, using ISO 9001 as a "framework" for its management system and that the policy is regularly reviewed to ensure continual suitability and effectiveness.
Where an organization would like to communicate numerous policies to provide a guidance frameork to its workforce, an "Employee Handbook" or equivalent is typically published to serve this purpose.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & ISO 27001 Certifications
Conformance to EU-GDPR
Answer:
Once a data breach has been identified, where there may be a potential impact on the data subject, (i.e., the person who owns the PII), the relevant data protection authority must be informed.
In ireland it is the Data Protection Commissioner. Their reporting form can be completed by clicking on the link.
In the UK, the Information Commissioners Office can be found here.
Please search for "Data Protection Authority" to identify the reporting body for your own juristiction.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & All ISO Management SYstems Standards
Answer:
An organization needs to be able to demonstrate that the customer objectives are established through adequate exchange of information to support product and service provision.
This can be addressed through:
Catalogues;
Service Level Agreements;
Non-disclosure Agreements, etc.
Design and development aspects also need to be addressed, where applicable.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & All ISO Management Systems Standards
Answer:
The Standards provide very good guidance in the notes supporting the established criteria. Culture can be considered from both external and internal perspectives in turn.
In ISO 9001, Clause 4.1:
Note 2 suggests that cultural aspects can inform external issues which may be relevant to an organization;
Note 3 speaks to organizational "culture" important when considering internal contextual issues.
External and internal issues relevant to culture can be a function of where the business is located, the local environment, social and economic environments, market and regulatory obligations,the nature of work, etc.
The relationships with interested parties and how their "culture(s)" may impact the organization, are also worth evaluating to determine relevant contextual issues.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & All ISO Management Systems Standards
Answer:
The Emplyee Handbook has been around for decades and serves a number of purposes for an organization. It is typically used to communicate information about an organization; from top management to all employees, including:
Welcome statement.
Mission statement.
Company policies.
Company procedures, including disciplinary procedures.
Non-disclosure agreements.
In support of ISO Certifications, we recommend to all our customers that they consider employing their Employee Handbook as a vehicle to carry relevant ISO management systems information, including responsibilities and authorities toward established policies and controls.
Answered by: Phil Byrne
Relevent to:
ISO 9001 & All ISO Management Systems Standards
Answer:
While this aspect is the primary focus of the criteria in clause 6.2 of ISO 9001, it is mentioned throughout the Standard in key areas.
The organizational objectives must be aligned to the strategic direction, policies, purpose, etc.
Objectives must be measurable, as in; achievable.
Address the requirements of legislation and applicable industry regulation.
Address the requirements os subscribed ISO Standards, codes of practice, and other acceptable certifications and approvals.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & All ISO Management Systems Standards
Answer:
The basic requirement of ISO management systems standards auditing is that core processes need to be audited at least once per calendar year. The additional consideration is for the nature of the work, and the criticality and complexity of the processes.
From an ISO 9001 perspective, the emphasis of the audit function should be to determine the effectiveness of the process activities, and the policies and controls established to manage them.
Extending this to areas such as Environmental (ISO 14001), or Health & Safety (ISO 45001) aspects; the focus should be on hazardous activities and working environments. Inspections of the working environment, to ensure the suitability and effectiveness of physical and technical controls are necessary. Testing of failovers and key mitigations should be incorporated into formal planning for audit or inspection.
For information and privacy security, where certification to ISO 27001 (& ISO 27701) is the objective; an organization must ensure that the controls established and documented in the Statement of Applicability (SoA) must be validated periodically. We recommend carrying out an analysis of the SoA to determine what should be inspected or audited on a monthly, quarterly and annual basis, and plan accordingly.
In all cases, the important consideration is that the frequency of audit and the level of detail and scrutiny should depend on the organization's own requirements, and the criticality and complexity of the process activities. Also required for consideration, under EU-GDPR, is the lifecycle of the data (PII) through organizational processes and systems.
Integrated management systems, such as the Enable ISO Total Management System (TMS) ensure that organization's can prepare and maintain a single management system for multiple ISO Certifications. Integrated auditing is also key to managing multiple ISO Certifications.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & All ISO Management Systems Standards
Answer:
PDCA = Plan, Do, Check, Act!
The PDCA cycle has been adopted by ISO for its relevant of Management Systems Standards. It is derived from the Deming PDSA cycle, where the "S" stands for Study.
Deming emphasised Study, rather than Check, as the focus on Check is more about the implementation of a change, with success or failure.
The focus of PDSA is on predicting the results of an improvement effort, studying the actual results, and comparing them to possibly revise the theory.
When developing our management systems, adopting the Study definition can be usefull.
Answered by: Phil Byrne
Relevant to:
ISO 9001 Certification (Where design and dvelopment is a feature within the organization)
Answer:
If your organization does not carry out design and development activities as part of your product and service offering, an ISO certification auditor will accept exclusions from the requirements of Clause 8.3.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & ISO 14001 Certifications
Answer:
Environmental aspects include; characteristics or conditions related to climate, pollution, resource availability, and biodiversity, and the effect these conditions may have on the organization’s ability to achieve its objectives.
Examples relevant to climate can be determined by considering how local climate impacts the organizations ability to operate. External processes may be negatively impacted by high wind, flooding, low or indeed high temperatures.
Similarly, organizational processes may rely on environmental inputs which may be negatively impated by pollution; air, water...
Also, the organization may have a negative impact on the local environment as a result of its operations.
Availability of resources may also need to be considered. The organization may be aware of issues relevant to its operations, but there may be constraints on environmental resources for effective management of these aspects. Competency, technology, finance, buy-in, etc., can feature strongly in this regard.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & All ISO Management Systems Standards
Answer:
Our recommendation to our clients is that they use our Management Review Form, which is developed using the criteria established in Clause 9.3.2 of ISO 9001, which provides for inputs into management review.
The criteria in this clause provides for a "fixed agenda", which ensures that we can always demonstrate that the entire criteria in the clause is being considered.
It is important to ensure that the management team contribute to the management review so that all aspects of the management system can be evaluated.
Answered by: Phil Byrne
Relevant to:
ISO 9001 Certification
Answer:
The changes to this Quality Management Standard were seen as significant with the publication of the 2015 version because of the introduction of strategic considerations throughout clauses 4,5 & 6.
Aspects being addressed for the first time are Contextual Issues, Interested Parties, Risk Based Thinking, and compliance with legislation and industrial regulation.
ISO 9001:2015 is generally considered to be a much improved Standard because of these changes.
Answered by: Phil Byrne
Relevant to:
ISO 27001 & ISO 27701 Certifications
Conformance to EU-GDPR
Reference: Mandatory contractual arrangements
Answer:
If we look at the criteria of the clause, word by word, it sets the focus upon high-level or strategic perspectives with regard to needs and expectations. At this point, the Standard requires that an organization considers legal and contractual requirements.
The logic is that, without understanding their needs and expectations, we cannot determine the requirements for a successful contract or trading relationship.
In practical terms, an auditor will expect that an organization presenting for audit will have a formal approach to the identification of requirements based on a good understanding of market expectations, industry regulation and applicable legislation, such as Health & Safety, Environmental and by no means least; EU-GDPR.
Requirements can include:
Data Protection Agreements (DPA) (Standard Contractual Clauses);
Non Disclosure Agreements;
Data Protection Impact Assessments.
In addition, where an organization is delivering its products and services into third parties where they are responsible for large volumes of data, particularly sensitive data, or where they are carrying out data analytics or profiling activities, there may be specific requirements to govern that relationship.
Typically, an organization operating in software engineering activities will be required to obtain ISO 27001 Certificatio to support their tendering objectives in relevant markets.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & All ISO Management Systems Standards
Answer:
It is important to note that there are two primary considerations when evaluating the suitability of a Certification Body with regard to accreditation:
A Certification Body can obtain accreditation for a Certification Scheme, such as ISO 9001, ISO 14001, ISO 27001, etc.;
The accreditation only applies to sectors of business where they can demonstrate appropriate levels of competency toward those sectors.
For example; a printing business, or a software engineering company can only be audited by a Certification Body where the assigned auditor has demonstrable competencies and experience in the relevant sector.
Certification Bodies also provide auditing services, with no accreditation. While these certifications may have some value, there is no oversight from a National Authority or Accreditation Board. For non-accredited certifications, the value can only be questionable.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & All ISO Management Systems Standards
Answer:
Specifically, those individuals who practice management at the highest level of the organization.
Answered by: Phil Byrne
Relevant to:
ISO 9001 and all ISO Management Systems Standards
Applicable legislation, including:
Health & Safety;
Environmental;
Data Protection (EU-GDPR).
Applicable industry regulation
Contractual arrangements
Answer:
Referring to the interpretation given to the criteria in clause 4.3, the requirement is to determine and document the scope of the management system, to include a description of its boundaries and applicability. Importantly, the scope must include consideration for the results of analysis of the requirements at clauses 4.1 and 4.2.
Boundaries can include:
Geographical - where the main operations are based, or global distibution can be significant to the context of an organization;
Market Sector - the market an organization operates in, or serves, may provide regulatory constraints, which become boundaries for consideration. For example,a security services provider may need to be licensed to operate in certain jurisdictions;
Technical - technology, competencies, product and service offerings, etc., can all be included in the scope as appropriate to the needs of an organization. Trends, including pace of change, can be important when considering this aspect.
The expectations of an auditor when reviewing the suitability of a scope statement are that it will be concise, factual, descriptive of the organization; and how it sees itself in its own market.
To understand the "applicability" aspect; consider the key processes in any organization. Take for example, a commercial laundry business, as follows:
2 key operations; workwear and linenwear;
Linenwear - no market pressure for ISO certifications;
Workwear - dealing with formal tendering contracts, with ISO Standards being significant.
Such an organization may successfully claim the exclusion of its Linenwear operations from the scope of its management system, so long as it can substantiate the claim.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & All ISO Management Systems Standards
Answer:
Annex SL refers to the hierarchy or structure of the ISO management systems Standards. All relevant Standards will follow the indexing with Clause 4 Context, 5 Leadership, 6 Planning, etc.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & All ISO Management Systems Standards
Answer:
ISO 9001 requires that an organization documents its operational and support processes to provide for instruction and control, where appropriate.
Other management systems Standards require more detailed documentation of processes. In particular, ISO 27001 requires that operational and support processes are documented to a level to provide for risk assessments of the lifecycle of the data through each process or system.
The typical expectation is that these processes will be documented in linear sequential order.
Answered by: Phil Byrne
Relevant to:
ISO 9001 and all ISO Management Systems Standards
Software Engineering & Development
Reference: ISO 90003:2018
Answer:
ISO 9001 requirements are for documented information to the extent necessary to support operations and record-keeping needs. The following recommendation is drawn from our analysis of the criteria in ISO 90003:2018.
4.4.1.1 Process identification and application:
The organization should also identify the processes for software development, testing, operation or maintenance, as applicable.
4.4.1.2 Process sequence and interaction:
The organization should also define the sequence and interaction of the processes.
Here, the Standard provides a little clarity in a language that any software engineer can understand. An ISO auditor will expect that the lifecycle model employed by the organization is documented, with an established set of criteria, or "code of practice", incremental, spiral, interative, and evolutionary (adaptive).
4.4.1.3 Evidence of effective operation.
The ISO 90003:2018 Standard provides plenty of examples of the types of evidence an auditor will expect in support of an organizations claim to conformance. In essence; the expectation is tha tthe software development lifecycle and associated activities will be fully incorporated into the ISO 9001 management system (QMS).
Answered by: Phil Byrne
Relevant to:
ISO 9001 Certification
Answer:
No: The 2015 version of ISO 9001 does not include a requirement for a "Quality Manual".
It is noted that many organizations we have audited, have maintained their quality manuals through to current certifications, as they find them invaluable because of the structures of their management systems.
Organizations newer to ISO Certification are not following this examaple, using the Standard itself to determine how it meets its own needs in this regard.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & All ISO Management Systems Standards
Answer:
The expectation of an ISO Standards certification auditor is that all process activities will be carried out in controlled environments, driven by policies and instruction to the extent necessary to provide for effective operations.
The extent of the formal control is dependent on the criticality and complexity of the process activities.
Answered by: Phil Byrne
Relevant to:
ISO 9001 & All ISO Management Systems Standards
Answer:
When developing the documentation required for the control of operational and support processes, you will consider the relevant Key Performance Indicators which are critical to management decision making.
It is important that appropriate monitoring and measuring is documented so that your organization can demonstrate that it provides the relevant data to provide for evidence based decision making.
Note that most organizations are using software applications to manage many processes. In most instances, these platforms provide reporting mechanisms to adequately provide for this aspect.
Answered by: Phil Byrne
Relevant to:
ISO 9001 All ISO Management Systems Standards
Answer:
Your certification auditor is required to verify that the organization is benefitting from formal management to achieve continual improvement.
Expectations for an organization presenting itself for 1st time certification audit will be very different to those of a mature system.
Incremental improvements identified through internal audit functions can provide evidence of this.
Management of organizational objectives through a register or equivalent becomes important to provide documented evidence of continual improvement.
Answered by: Phil Byrne
This section of the Enable ISO website is dedicated to providing a our visitors with a free resource to help them on their ISO Certification journey. Please use the chat box to ask any questions you may have.