How to structure the documents for ISO 14001 Annex A controls?

 

ISO 14001 Certification in Saudi Arabia Once you’ve finished your risk assessment and treatment, it's time for you to begin writing documents that describe your security controls in keeping with ISO 14001 Annex A. But, those documents must you write? however, does one structure them? that one does one begin with?

 

Here’s what I found to be the simplest thanks to the couple.

How to select those documents to write down?

ISO 14001 In Saudi Arabia says that you simply that you just cannot simply begin to pick the controls and/or write the documents that you simply just like the most – the purpose is that choice of controls should be an on the spot consequence of the danger assessment and risk treatment method. See also: ISO 14001 risk assessment & treatment – six basic steps.

Secondly, you want to recognize that documents are obligatory and that aren't – see this list here: List of obligatory documents needed by ISO 14001 (2013 revision).

Finally, once you recognize that controls should be applied and that documents are obligatory, you want to decide however intensive your documentation can be:

Smaller corporations can tend to own a smaller range of documents: (1) they won’t document every management, and (2) they're going to embody many controls in an exceedingly single document.

Larger corporations can tend to own a lot of documents, and therefore the documents are going to be a lot of elaborated.

 

Which documents ought to cowl that controls?

Since Annex A has 114 controls, ISO 14001 Services in Saudi Arabia the reality is that it's not straightforward to make a decision away to cluster policies and procedures to hide them (see also: summary of ISO 14001:2013 Annex A). and therefore the undeniable fact that ISO 14001 doesn't impose that controls should be allotted to that policy and/or procedures would possibly at first appear to be a tangle, however, once you notice that such Associate in Nursing approach provides you massive freedom to adapt the documentation to your real company desires, you may become grateful that ISO 14001 is therefore versatile.

 

 

Again, there are 2 approaches to cluster the documents:

Smaller corporations can unremarkably have policies and/or procedures that cowl many controls with one document solely – as an example, you may use:

Access management Policy to hide all the fourteen controls from section A.9 (without writing elaborated procedures),

BYOD (Bring Your Device) Policy to hide not solely A.6.2.1 (Mobile device policy) and A.6.2.2 (Teleworking), but also A.13.2.1 (Information transfer policies and procedures),

with Acceptable Use Policy, you may get even a lot of bold and canopy controls from varied sections of Annex A, since this document may function as a security baseline for all employees: A.6.2.1, A.6.2.2, A.8.1.2, A.8.1.3, A.8.1.4, A.9.3.1, A.11.2.5, A.11.2.6, A.11.2.8, A.11.2.9, A.12.2.1, A.12.3.1, A.12.5.1, A.12.6.2, A.13.2.3, and A.18.1.2.

Bigger corporations sometimes structure the documentation in an exceedingly completely different way:

each section from Annex A are going to be lined with a policy – e.g., Organization of knowledge Security Policy (A.6), Human Resources Security Policy (A.7), plus Management Policy (A.8), etc.

each policy can have elaborated procedures and/or operating directions that cowl single controls – as an example, data classification procedure (for management A.8.2.1), data labeling procedure (control A.8.2.2), data handling procedure (control A.8.2.3), etc.

 

The sequence of writing the documents

ISO 14001 consultant in Saudi Arabia Once you've got a concept of a way to structure the documents, however, does one decide wherever to begin, and wherever to end?

For smaller corporations, you'll be able to use some of the criteria to make a decision that documents, to begin with:

Areas wherever you'll be able to get fast wins – this suggests you'll be able to choose a region wherever you recognize you may end your document quickly, and in this manner, you show your management, your peers (and yourself) that you simply are capable of doing this job effectively.

Areas wherever you've got the largest risks – this manner you begin resolution the largest issues 1st –you might not end this quickly, however typically this approach is critical if your risk assessment has shown you've got some massive gaps to fill in.

Areas that are compatible with different running comes in your company – as an example, if your company is presently implementing a facilitate table software system, you may wish to begin writing incident management procedure, as a result of this can regulate however that software system is going to be utilized in the context of ISO 14001.

For documents that are to be written at the top, my personal preference is documenting that cowl larger range of controls (for example, the suitable Use Policy). this manner you may recognize that controls you lined with different documents and people that haven’t been delineated in different policies Associate in Nursing procedures are often delineated in an all-embracing document at the finish. Again, larger corporations can have a distinct approach – they're going to write the policies 1st, and connected procedures/working directions second, whereas for the choice on that policies to begin 1st they will use a similar criterion as delineate on top of. So, to conclude, ensure you utilize this flexibility that ISO 14001 in Saudi Arabia offers you to adapt the documentation to your specific desires – as a result of the thought is that the documentation serves you, not the opposite manner around.

 

How to get ISO 14001 Consultant in Saudi Arabia?

Are you looking to get certified the new version of ISO 14001 standard? Certvalue is Having Top Consultant to give ISO 14001 Services in Saudi Arabia .it helps the organization to meet its Customer Requirements. After getting Certified under ISO 14001 Certification in Saudi Arabia it helps to get more income and business for new customers. We are the top Certvalue Service provider for each one of your necessities. Feel free to send an inquiry to certvalue.com