|
|
|
|
|
|
|
|
|
|
|
|
|
|||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
This e-Newsletter is in HTML
format and may not be displayed properly by some email programs. Please
click on our web site address above
to see the e-Newsletter with its proper formatting.
ISO
17799:2005 - Information Technology - Security Techniques - Code of
Practice for Information Security Management Any organization has assets, essential to its continuity. Arguably, information in its various forms is the most important asset, be it printed, stored electronically, posted or e-mailed, shown on film or spoken. For most businesses, information security may be essential to maintain competitive edge, cash flow, profitability, legal compliance, and commercial image. But, many businesses and most non-business organizations may hold information as their only asset. An absence of information security may threaten their integrity and, therefore, their very existence. ISO 17799:2005 recognizes that the level of security that can be achieved purely through technical means is limited. The required level of security (established through assessing the levels of risk and associated costs through breaches of security, against the costs of implementing security) should always be driven by appropriate management controls and procedures. Information security management requires, at a minimum, participation by all employees in the organization. It may also require participation from shareholders, suppliers, third parties, and customers. ISO 17799:2005 identifies the controls that form the starting point for information security. It covers:
Ted Humphreys, Convenor of the ISO working group that developed ISO 17799:2005, said: “The revised version of this standard provides organizations with many state-of-the-art additions and improvements in information security best practice." “For example, better management of security arrangements with external businesses, outsourcing and service providers, enhanced incident handling capability, dealing with problems of patch management, mobile devices, wireless technologies and harmful mobile code via the Internet, improvements in best practice managing human resources, and several other new features.” “In summary, this revised ISO 17799 is the most important of standard for managing information security that has been developed – it establishes a truly international common language for information security for all organizations around the world to engage with each other to do business.” ISO 17799:2005 can be ordered at: <http://webstore.ansi.org>.ISO 27001:2005 - Information Technology - Security Techniques - Information Security Management Systems - Requirements This new standard is planned for publication in November of this year. ISO 27001:2005 will complement ISO 17799:2005 and provide a specification for Information Security Management Systems and the foundation for third party audits. Quality management systems are supported by large amounts of electronic information. And, many of these records must be kept for long times. Of course, when the retention periods are over, you want to dispose of the records in a way that protects the confidentiality of your business and personal data. Does your records management process address the data residing on old computers that are ready for sale, recycling, or destruction? Does your organization understand that erased data on an old computer drive may still be retrievable? There are a number of options for cleansing the drives of unwanted computers, from special wiping software to destruction services to manufacturers' recycling programs. But what many computer owners don't realize, is that these methods are often not enough. There are signs that people are not aware of the risk from discarded drives. Last year, German encryption technology specialist Pointsec tested hard drives bought on eBay to see if they still carried data and discovered that seven out of every 10 devices it tested still retained readable information. "What we've seen with a lot of clients is that they think that reformatting a drive gets rid of the data, and that's just not true," says Kathy Ferguson, a business unit manager with IBM's Asset Recovery Solutions Group. "In a typical scenario, that only overwrites partitions, or sectors of data. At the end of the day, you can recover that data readily if you have the right tools." Wiping software is the obvious next choice for eliminating the data. Most of these technologies revolve around software meant to overwrite the information on the devices with a random series of numbers. By using multiple overwrites featuring different character sets, you can approach the same level of protection required by the U.S. Department of Defense, which requires a minimum of at least four passes with wiping tools (in cases where the DoD does not mandate the drive be destroyed). Experts say the best approach in trying to completely erase information is to use a combination of data removal software and material destruction. All of the major computer makers and most hard-drive makers offer recycling programs where they will professionally destroy the data devices. This article was based on a report written by Matt Hines for CNET News.com. Click on Skeletons on Your Hard Drive to read the full article. ISO has published a short information brochure,ISO 9001:2000 - What does it mean in the supply chain? This document is aimed at managers who are involved in selecting suppliers and making purchasing decisions, who may well encounter suppliers that claim to have an ISO 9001:2000-based quality management system. The brochure addresses the following main topics:
The brochure is the work of the ISO 9000 Advisory Group (IAG). Co-Chair of the IAG, Nigel Croft, explained: "The IAG developed its informative brochure for the intended audience of purchasers in a business-to-business environment, who are not necessarily certified to or even familiar with ISO 9001:2000. It provides answers to questions they may have such as:
Nigel Croft added: "One of the primary
objectives of ISO 9001:2000, as described in Clause 1.1 of the standard
is 'to specify requirements for a quality management system where an
organization ... needs to demonstrate its ability to consistently
provide
product that meets customer and applicable regulatory requirements
...'. The Sarbanes-Oxley Act of 2002 (SOX) impacts on both user and service organizations. In this article, Luc Klein of LogicaCMG describes the options firms have for compliance, the specific issues they must be aware of, and why time is running out for non-U.S. companies that are listed in the United States. As companies choose to devote key resources to core business activities, it is increasingly common for supporting functions to be outsourced. These often include IT-intensive activities such as information processing, claims management, and payroll. Drivers for outsourcing include more efficient and effective cost and risk management, as well as, improved service delivery and greater speed to market. Under SOX (Section 404), organizations are responsible for ensuring that the service providers of any outsourced functions have documented their financial processes, carried out a risk assessment, and have in place adequate controls over financial reporting, which have been thoroughly tested for their effectiveness This responsibility can never be delegated to the service provider by the user organization. In addressing SOX requirements, companies (particularly user organizations) must ask:
If a user organization has large control over its outsourced activities, then it may need to be involved in performing risk and control assessments of the service provider, as well as, testing that the controls are effective. The user organization may ultimately use internal or external audits to evaluate its service provider’s control environment as an extension of normal audit procedures. It is important to determine contractual provisions for financial control auditing and to agree to the audit process between the user and service provider. In some cases, it may not be practical to audit service providers from a service providers’ standpoint. This may be particularly true when multiple clients seek audits that may place burdens on the service provider’s resources, each looking for a range of assurances about internal controls. Reliance on Service Provider Audits Service providers may opt for a Statement on Auditing Standards (SAS) No. 70, Service Organizations. This is an internationally recognized auditing standard developed by the American Institute of Certified Public Accountants (AICPA). SAS 70 is accepted under SOX in relation to section 404. A SAS 70 audit involves an external, independent evaluation of service provider controls, their execution, and effectiveness. The audit, which is typically conducted by the service provider’s external auditor, addresses critical benchmarks, including completeness, accuracy, and timeliness of the control activities and processes. There are two types of SAS 70 audit reports. Type I describes the service provider’s internal controls at a specific point in time, for example, at fiscal year-end. Type II not only includes the service provider’s description of internal controls, but also detailed testing of them over a minimum six-month period. With a SAS 70 report, user firms will not have to conduct their own audit of the service provider’s controls. Service providers may use a SAS 70 report for commercial purposes as well. SOX compliance and provision of a SAS 70 report as a standard can offer competitive advantage. Conclusion Under SOX, companies are not only responsible for having their internal processes in order, but they also remain responsible for controls of any outsourced activities. User and service providers have various options open to them. Users can ensure service provider compliance by conducting an audit themselves (by either their own internal or external auditor). Or, they can rely on audits provided by their service provider by means of a SAS 70 (or similar) statement by the service provider’s auditor. There are also specific issues organizations must know, such as timing of a SAS 70 statement; or the possibility of using an alternative standard. As non-U.S. companies must comply with SOX requirements from July 15, 2006, time is running out, especially for those at the early stages of planning, or worse, have yet to start. They may have to employ additional capability and resources in order to meet the SOX deadline. About the Author Luc Klein, MBA, is a senior business consultant in LogicaCMG’s finance business consulting unit. Contact at risk.solutions@logicacmg.com. Reprinted with permission. You're
probably familiar with the ISO 9001:2000 requirements for an internal
audit program. But, have you thought about improving your internal
audits by considering the extra requirements and guidance from the
different industry sector schemes? Well, read on, because after a brief
review of the ISO 9001:2000 audit requirements, you'll hear about
additional requirements (AS9100, TL 9000, ISO/TS 16949, ISO 13485, and
ISO 14001)
and guidance (ISO 9004, ISO 14004, ISO
90003, and ISO 19011) to consider for your
internal audit program.
Aerospace - AS9100 In addition to the basic ISO 9001:2000 requirements, AS9100B:2004 states that detailed tools and techniques must be developed, such as, checksheets, process flowcharts, or similar methods to support audit of the quality management system requirements. The acceptability of the selected tools will be measured against the effectiveness of the internal audit process and overall organization performance. Internal audits must also meet contract and/or regulatory requirements. Telecommunications - TL 9000 TL 9000, Release 3.0, doesn't add any requirements to those expressed in clause 8.2.2 of ISO 9001:2000. Automotive - ISO/TS 16949 In addition to the basic ISO 9001:2000 requirements, ISO/TS 16949:2002 adds five sub-clauses: 8.2.2.1 Quality Management System Audit The organization must audit its quality management system to verify compliance with ISO/TS 16949 and any additional quality management system requirements. 8.2.2.2 Manufacturing Process Audit The organization must audit each manufacturing process to determine its effectiveness. 8.2.2.3 Product Audit The organization must audit products at appropriate stages of production and delivery to verify conformance to all specified requirements, such as, product dimensions, functionality, packaging, and labeling at a defined frequency. 8.2.2.4 Internal Audit Plans Internal audits must cover all quality management related processes, activities, and shifts, and must be scheduled according to an annual plan. When internal or external nonconformities or customer complaints occur, the audit frequency must be appropriately increased. Note: Specific checklists should be used for each audit. 8.2.2.5 Internal Auditor Qualification The organization must have internal auditors who are qualified to audit the requirements of ISO/TS 16949. Environment - ISO 14001 ISO 14001:2004, clause 4.5.5, is similar to ISO 9001:2000, clause 8.2.2, except: ISO 9001 says the organization must conduct internal audits, while ISO 14001 states the organization must ensure they are conducted. ISO 9001 says to determine if the system has been effectively implemented, while ISO 14001 says to determine if the system has been properly implemented. 14001 leaves out that the management for the area being audited must ensure the actions are taken without undue delay to eliminate detected nonconformities and their causes (since addressed adequately by 4.5.3 in 14001 on Nonconformity, Corrective Action, and Preventive Action). Also, ISO 14001 leaves out coverage of follow-up activities for the verification of actions taken and the reporting of verification results. ISO 14001:2004, A.5.5, states that internal audits of an environmental management system can be performed by personnel from within the organization or by external persons selected by the organization, working on its behalf. In either case, the persons conducting the audit should be competent and in a position to do so impartially and objectively. In smaller organizations, auditor independence can be demonstrated by an auditor being free from responsibility for the activity being audited. Note: If an organization wishes to combine audits of its EMS with environmental compliance audits, the intent and scope of each should be clearly defined. Environmental compliance audits are not covered by ISO 14001. Environment - ISO 14004 Clause 4.5.5 of ISO 14004:2004, EMS - General Guidelines on Principles, Systems, and Supporting Techniques, states that internal audits of an organization's environmental management system should be conducted at planned intervals to determine and provide information to management on whether the system conforms to planned arrangements and has been properly implemented and maintained. They can also be performed to identify opportunities for improvement in an organization's environmental management system. An organization should establish an audit program to direct the planning and conduct of audits and identify the audits needed to meet the program's objectives. The program should be based on the nature of an organization's operations, in terms of its environmental aspects and potential impacts, the results of past audits, and other relevant factors. Each internal audit need not cover the entire system, so long as the audit program ensures that all organizational units and functions, system elements, and the full scope of the environmental management system are audited periodically. The audits should be planned and conducted by objective and impartial auditors, aided by technical experts, where appropriate, selected from within the organization or from external sources. Their collective competence should be sufficient to meet the objectives and scope of the particular audit and provide confidence as to the degree of reliability that can be placed on the results. The results of an internal environmental management system audit can be provided in the form of a report and used to correct or prevent specific nonconformities, fulfill one or more objectives of the audit program, and provide input to the conduct of the management review. Medical Devices - ISO 13485 ISO 13485:2003, Medical Devices - Quality Management Systems - Requirements for Regulatory Purposes, doesn't expand on the basic audit requirements of ISO 9001:2000. Software - ISO 90003 ISO 90003:2004, Guidelines for the Application of ISO 9001:2000 to Computer Software, states that when software organizations separate their work into projects, audit planning should define a selection of projects and assess both the compliance of their project quality planning to the organization’s quality management system and the compliance of the project to the project quality planning. This selection should ensure coverage of all stages and all processes. This may necessitate auditing various projects at different stages of their product development life cycle, or auditing a single project as it progresses through various stages. Where the intended project changes its timescale, the internal audit schedule may be reviewed, either to change the timing of the audit, or to consider a different project. Other Sources - ISO 19011 and QE19011S ISO 19011:2002 provides guidelines for quality and/or environmental management system auditing. It gives suggestions for conducting internal and external audits, as well as, on the competence and evaluation of auditors. Although supplementary guidance and examples are provided in ISO 19011:2002, the US decided additional guidance was necessary. Therefore, QE19011S:2004 was published with the ISO 19001:2002 text, plus extra guidance for first-party (internal) audits, second-party (external) audits, and small organizations.
To enroll in these public classes, you can click on the course title, go to Class Schedule at our web site, or call us at 800-404-7585. Classes taught by Larry Whittington are shown in yellow.
ISO
9001:2000 Lead
Auditor (RABQSA Certified) - BSI Management Systems
ISO 9001:2000 Internal Auditor (RABQSA Certified) - BSI Management Systems Initial course version developed by an Associate at Whittington & Associates
Implementing ISO 9001:2000 Course developed by Larry Whittington
Understanding ISO 9001:2000
Understanding ISO 9001:2000 Requirements (Atlanta Only - $295) Course developed by Larry Whittington
Quality System Documentation (ISO 9001:2000) Course developed by Larry Whittington
The above public courses can be offered on-site at your facility. In addition, we offer these on-site courses:
© 2000-2005 Whittington & Associates, LLC. All rights reserved. You may copy this e-Newsletter provided you copy it completely, do not change it, and include this copyright notice. |
|
|
|
|
|
|
