Welcome to the Whittington & Associates e-Newsletter!
Visit and bookmark our web site today: http://www.WhittingtonAssociates.com

A new Information Technology series of standards is being published on Security Techniques for IT networks.

The ISO 18028 standards detail the specific operations and mechanisms needed to implement network security safeguards and controls in a wide range of network environments, providing a bridge between general IT security management issues and network security technical implementations. ISO 18028 comes in five parts:

ISO/FCD 18028-1:200x - Information Technology - Security Techniques - IT Network Security - Part 1: Network Security Management
Defines and describes the concepts associated with, and provides management guidance on, network security.

ISO 18028-2:2006 - Information Technology - Security Techniques - IT Network Security - Part 2: Network Security Architecture
Defines a standard security architecture, which describes a framework to support the planning, design, and implementation of network security.

ISO 18028-3:2005 - Information Technology - Security Techniques - IT Network Security - Part 3: Securing Communications Between Networks Using Security Gateways
Defines techniques for securing information flows between networks using security gateways.

ISO 18028-4:2005 - Information Technology - Security Techniques - IT Network Security - Part 4: Securing Remote Access
Provides guidance for accessing networks remotely - either for using email, file transfer, or simply working remotely.

ISO/FCD 18028-5:200x - Information Technology - Security Techniques - IT Network Security - Part 5: Securing Communications Across Networks Using Virtual Private Networks
Defines techniques for securing inter-network connections that are established using Virtual Private Networks (VPNs).

Information held by IT products or systems is a critical resource that enables organizations to succeed in their mission. Additionally, individuals have a reasonable expectation that their personal information contained in IT products or systems remain private, be available to them as needed, and not be subject to unauthorized modification. IT products or systems should perform their functions while exercising proper control of the information to ensure it is protected against hazards such as unwanted or unwarranted dissemination, alteration, or loss.

The term "IT security" is used to cover prevention and mitigation of these and similar hazards. Many consumers of IT lack the knowledge, expertise, or resources necessary to judge whether their confidence in the security of their IT products or systems is appropriate, and they may not wish to rely solely on the assertions of the developers. Consumers may therefore choose to increase their confidence in the security measures of an IT product or system by ordering an analysis of its security (i.e., a security evaluation).

ISO 18045 is a companion document to the ISO 15408 family of standards:

ISO 18045:2005 - Information Technology - Security Techniques - Methodology for IT Security Evaluation
It describes the minimum actions to be performed by an evaluator in order to conduct an ISO 15408 evaluation, using the criteria and evaluation evidence defined in ISO 15408.

Copies of these IT Security standards can be acquired at the ANSI e-Standards Store.

The Production Part Approval Process (PPAP), 4th Edition manual will be released on March 1, 2006. The PPAP manual defines requirements for the production part approval process, as defined by Chrysler Group, Ford Motor Company, and General Motors. It has been updated to align with the automotive "process approach".
 
The new PPAP manual includes the following changes:

• Alignment of PPAP to the ISO/TS 16949:2002 process approach
• Relocation of Customer Specific Instructions to appropriate Web sites to provide more current requirements
• Update of Truck OEM requirements and moved to Appendix H
• Revised Part Submission Warrant (PSW)
• Updated specific PPAP requirements, including:

1. Materials reporting and polymeric identification requirements in the design record
2. Process capability index usage (Cpk and Ppk)
3. The definition and approval catalog parts and definition of black box parts

• Modified customer notification and submission requirements to align with OEM requirements
• Clarified and communized Appendices C, D, and E to match the PPAP reporting requirements
• Revised Tire Appendix to allow OEM specification of applicability and to eliminate duplications with allowances already provided in the PPAP requirements
• Reorganized and updated Appendix F to stress the importance of the Bulk Materials Checklist
• Revised Glossary to be consistent with the updates in the text

The Production Part Approval Process, Fourth Edition is exclusively available from the Automotive Action Group (AIAG) at a price of $20 for members and $60 for non-members. To purchase, visit the AIAG Online Store or call AIAG customer service at 248-358-3003.

IWA 1:2005 provides guidance for any health service organization involved in the management, delivery, or administration of health service products or services, including training and research, in the life continuum process for human beings, regardless of type, size, and the product or service provided.

IWA 1:2005, Quality Management Systems - Guidelines for Process Improvements in Health Service Organizations, can be acquired at the ANSI e-Standards Store. Other International Workshop Agreement (IWA) standards for quality management systems that are available at ANSI include:

IWA 2:2003 Quality Management Systems - Guidelines for the Application of ISO 9001:2000 in Education
IWA 4:2005 Quality Management Systems - Guidelines for the Application of ISO 9001:2000 in Local Government

The Aberdeen Group recently issued a report that revealed more than half of best-in-class companies cite enforcement of quality procedures as the top strategic action for their business. Manufacturers that have developed a quality management program that spans from suppliers, through sales and production, and out to the end-customer are achieving competitive advantage.

According to the research presented in the report, "The Product Quality Benchmark Report: Achieving Quality across the Global Manufacturing Network", leading manufacturers are creating competitive advantage by incorporating performance metrics into production and business processes, implementing corporate education initiatives, and embedding corrective actions into standard operating procedures.

This benchmark study reveals that best-in-class companies are much more likely to have a global quality program in place. And, they are four times more likely than average performers to empower their decision makers with web-based, integrated technologies. Many of these leading companies are also considering either business intelligence solutions or corporate-wide quality databases to help further their quality goals within the next two years.

According to the Aberdeen Group, manufacturers should create a comprehensive quality management strategy that spans procurement, product lifecycle management, enterprise resource planning, manufacturing execution systems, customer relationship management, and their document management systems. Quality metrics, functions, and data should be managed across both the supply chain and the product lifecycle, transcending functionally-oriented systems. For more information, go to the Aberdeen Group web site.

ISO 14001:2004 is concerned with environmental management so an organization can:

• minimize harmful effects on the environment caused by its activities
• achieve continual improvement of its environmental performance

To enroll in these public classes, you can click on the course title, go to Class Schedule at our web site, or call us at 800-404-7585.

Classes taught by Larry Whittington are shown in yellow.

Quality Management System Courses
ISO 9001:2000 Lead Auditor (RABQSA Certified) - BSI Management Systems
Initial course version developed by Larry Whittington 

• ISO 9001:2000 Auditor Update - The Process Approach (1 Day) - Course developed by Larry Whittington
• Understanding ISO/TS 16949:2002 Requirements (1 Day) - Course developed by Larry Whittington
• Understanding ISO 14001:2004 Requirements - Course developed by Larry Whittington
• Internal Quality Auditing (2 Days) - Course developed by Larry Whittington (based on ISO 19011)
• AS9100B: Requirements Beyond ISO 9001:2000  (1 Day) - Course developed by Larry Whittington

Copyright © 2000 - 2007  Whittington & Associates, LLC.
All Rights Reserved.
242 Highlands Drive, Woodstock, GA 30188
770-517-7944 or fax 770-517-7945

 
Whittington & Associates provides training, consulting and auditing services for quality systems based on
ISO 9001, ISO/TS16949, TL9000, AS9100, ISO 13485, as well as, ISO 27001, ISO 20000, ISO 22000, and ISO 14001.