Explanation of the basic terminology in ISO standards

 

When I deliver varied training for ISO Certification in Saudi Arabia, it continuously seems that one of the most popular topics is concerning that policies and procedures got to be documented, and that don't. Of course, their area unit another heated discussion still, however several of these happen as a result of for somebody new within the ISO world (not solely in ISO 27001 and ISO 22301, however additionally in ISO 9001, ISO 14001, ISO 20000, etc.) it's dangerous to grasp some specific phrasing in those standards – here is that the rationalization of the terms that cause the foremost common doubts.

 

Which policies and procedures got to be documented?

When you see the words policy or procedure in Associate in Nursing ISO in Saudi Arabia normal, this doesn't mean that such a document has to be written. A policy or a procedure has to be written providing the word documented stands next to that. as an example, Access management policy from ISO Services in Saudi Arabia management A.9.1.1 has to be written down as a result of the management says “… policy shall be established, documented, and ….” As critical that, Backup policy doesn't to be written down as a result of up to speed A.12.3.1 of ISO 27001 there's no mention of the word documented. Why does ISO Certification in Saudi Arabia mention the words policy or a procedure if they don’t get to be documented? as a result of a policy or a procedure may even be expressed verbally, while not writing it down. as an example, you'll be able to outline a straightforward procedure (like responsive the phone) quite exactly by verbally deeming all participants on however it has to be done – you don’t get to write a document for it. Also, ISO consultants in Saudi Arabia some policies in a neighborhood of the data systems configuration (e.g., the countersign policy) while not having a separate document for it.

 

 

The distinction between shall and may

You need to implement bound demand of the quality providing you see the word shall – once you see ought to this can be not obligatory. This distinction is that the most evident between the standards that specify needs and therefore the standards that area unit solely pointers– in ISO Certification in Dubai you may repeatedly see the word shall, whereas ISO Services in Dubai primarily uses ought to. This is as a result of ISO Certification in Saudi Arabia may be a normal against that your company will get certified, therefore it specifies what you want to do to accommodates it; ISO consultant in Dubai area unit solely the rules for the implementation, therefore this can be one thing you'll or might not use. 

 

Which components of the quality area unit mandatory?

Solely the most a part of the quality (clauses one to ten) is obligatory but in most standards solely clauses four to 10 area unit obligatory for the certification; the annexes should be enforced providing they need the word normative next to them. For example, Annex A of ISO 27001:2013 is termed “Annex A (normative) Reference management objectives and controls,” which implies it should be enforced (of course, implementation of every management depends on the results of the danger assessment). As critical, Annexes A and B in ISO 9001:2008 area unit informative, which implies they're not obligatory – they exist solely to administer you some further data.

 

What are you able to exclude from the scope?

Be aware once you see the word scope, as a result of its outlined rather otherwise from one ISO normal to a different. as an example, once shaping your scope in ISO in Dubai, you shouldn’t scan solely clause one referred to as “Scope,” however additionally clause four.3 referred to as “Determining the scope of the data security management system.” once the word scope is mentioned in ISO in Saudi Arabia, it doesn't mean you'll be able to exclude some controls as a result of you don’t like them or as a result of you're thinking that they're too expensive; the exclusion of controls is allowed solely once you assess the risks – once you notice there aren't any risks that will need bound controls. cf. the way to outline the ISMS scope.

Make your implementation easier

What’s the purpose of all this? If you perceive however the ISO Certification in Dubai area unit written, you may have a far easier job in implementing them. as an example, you don’t want a document anytime a policy or a procedure is mentioned; you don’t get to implement one thing unless is says shall; you don’t get to implement all the annexes, solely those that area unit normative; and at last, if you set your scope properly at the starting you may have a far easier job throughout your whole implementation.

 

How to get ISO Certification in Saudi Arabia?

Are you looking to get the new version of ISO Certification in Saudi Arabia? Certvalue is Having Top Consultant to give ISO Consultants in Saudi Arabia.it helps the organization to meet its Customer Requirements. After getting Certified under ISO Services in Saudi Arabia it helps to get more income and business for new customers. We are the top Certvalue Service provider for each one of your necessities. Feel free to send an inquiry to certvalue.com