3 ms·

> "Globally recognized standards, such as ISO 27001, 27701 and 9001, can definitely ensure a baseline of security, privacy and quality assurance amid suppliers.

> "Globally recognized standards, such as ISO 27001, 27701 and 9001, can definitely ensure a baseline of security, privacy and quality assurance amid suppliers. One should, however, bear in mind that they are no silver bullet and some additional monitoring of suppliers handling critical business data is a requisite.” This is misleading. ISO standards dictate that a company should have certain processes in place. Like quality assurance, customer satisfaction, continuous improvement, ect. They do not specify individual processes or procedures to the company. They just lay out which structures should exist in an ISO compliant company. It is up to the company to develop processes and procedures that fulfill those structures. The specific standards that are a "silver bullet" (as the author puts it) are NIST 800-171 "DFARS", ITAR, AS9100, NADCAP, and other smaller (yet equally significant) manufacturer-specific specifications that get flowed down the supply-chain on an as-needed basis. So there is no ambiguity. If a supplier does business with a diverse enough client base in aerospace they will almost certainly have overlapping systems in place to protect against these things. Without pretty much all of the specifications I listed above, a supplier would not legally limited in what they are allowed to possess and produce.

dmix 7y ago
Do companies with ISO certifications ever get reviewed after-the-fact? Or do you just have to check the right checkboxes during an initial review process?
- zelon88 7y ago
  I'm pretty sure ISO 9001 companies are audited every 4 years at their own expense. Basically an auditor comes and quizzes you on your own processes. You must show that you have processes which meet ISO criteria, and that you religiously follow those processes. Basically you have a lot of freedom to develop your business, just be sure you adhere to whatever you put into writing.
  - thombat 7y ago
    Back in the day of Total Quality Management and ISO9002 the software company I worked for decided to get itself certified. Problem was, nobody had a clue how to quickly describe the business of creating software as a set of processes, let alone apply them in measurable ways under the beady gaze of an auditor. So with evil inspiration it was decreed that the software division had no processes at all. The customers could rest assured that the Accounts and Marketing departments were fully ISO9002 compliant - as for the actual product they were buying? spun out of desperate sweat and divine revelations so far as they could tell. But this didn't entirely get the software division off the hook. We still had to be able to show an auditor that we knew our processes were excluded. So there was a special folder containing just one functional page besides the meta-bumf to support it, and it read (in effect) "THE ACTIVITIES OF THE SOFTWARE DEPT ARE EXCLUDED FROM ISO9002 PROCESSES". And we were all trained to be able to produce it upon demand. We passed the audit. Our letterhead paper gained the magical ISO9002 seal of approval. The administrator who had championed the long and expensive business sprung from its success to a much larger company. In her absence the process documentation for the rest of the company quietly withered and when the follow-up audit came due we quietly neglected to apply for it. The letterhead paper was reprinted with a snazzier logo and no seal of approval. We got back to work, quietly apprehending the next big thing.
    - zelon88 7y ago
      That is a great story! I've seen companies pack trunks of cars with unclaimed scrap. Buy a 55' trailer with cash, fill it with stuff, then claim it belongs to the neighbors. Load material onto 30' racks and send the forklift operators home. It's almost better that your company committed to ISO to kinda get organized and then let it slide afterwards. I'd almost say it's worth it in a medium sized company every 10 years just to stay accountable and organized.
    - quickthrower2 7y ago
      It was all worth it for the line on her resume.
  - eyegor 7y ago
    > I'm pretty sure ISO 9001 companies are audited every 4 years at their own expense Eh, kind of? I currently work for one and they haven't been audited in over a decade. The history goes: once upon a time, they were seeking certification because $potential_buyer asked about it. They failed the first audit quite miserably, and the next. By the third time, they squeezed by and were certified. The auditors came back 2 times in the next 2 years to make sure they were still compliant, and by the third year the auditors just asked if their processes had changed (without bothering to scrutinize everything again). They had not, and the auditors have not reached out ever since. The company is still certified. I think in theory they've "checked" since then but no one at the company can recall them actually showing up/auditing.
- jacquesm 7y ago
  Almost every certification is a recurring income generator for the certificating parties. Some are annual, others bi-annual or even longer periods between certifications but none that I am aware of are 'forever'.
  - dmix 7y ago
    That makes sense. My goal in life is to never work for a company where that type of thing would be considered seriously.
    - jacquesm 7y ago
      So, the following are out: aerospace, fintech, medtech, insurance, anything requiring a login through a local account (not through some identity provider) and so on. You'd be surprised how many companies are now operating in territory where certification is either a hard requirement or where it will help them to ensure that they are good stewards of the data they hold.
- dyu 7y ago
  ISO27001 (the main security one) has annual reviews which are more lightweight. After two years, the three-year cycle restarts.

dmix 7y ago

Do companies with ISO certifications ever get reviewed after-the-fact? Or do you just have to check the right checkboxes during an initial review process?

zelon88 7y ago
I'm pretty sure ISO 9001 companies are audited every 4 years at their own expense. Basically an auditor comes and quizzes you on your own processes. You must show that you have processes which meet ISO criteria, and that you religiously follow those processes. Basically you have a lot of freedom to develop your business, just be sure you adhere to whatever you put into writing.
- thombat 7y ago
  Back in the day of Total Quality Management and ISO9002 the software company I worked for decided to get itself certified. Problem was, nobody had a clue how to quickly describe the business of creating software as a set of processes, let alone apply them in measurable ways under the beady gaze of an auditor. So with evil inspiration it was decreed that the software division had no processes at all. The customers could rest assured that the Accounts and Marketing departments were fully ISO9002 compliant - as for the actual product they were buying? spun out of desperate sweat and divine revelations so far as they could tell. But this didn't entirely get the software division off the hook. We still had to be able to show an auditor that we knew our processes were excluded. So there was a special folder containing just one functional page besides the meta-bumf to support it, and it read (in effect) "THE ACTIVITIES OF THE SOFTWARE DEPT ARE EXCLUDED FROM ISO9002 PROCESSES". And we were all trained to be able to produce it upon demand. We passed the audit. Our letterhead paper gained the magical ISO9002 seal of approval. The administrator who had championed the long and expensive business sprung from its success to a much larger company. In her absence the process documentation for the rest of the company quietly withered and when the follow-up audit came due we quietly neglected to apply for it. The letterhead paper was reprinted with a snazzier logo and no seal of approval. We got back to work, quietly apprehending the next big thing.
  - zelon88 7y ago
    That is a great story! I've seen companies pack trunks of cars with unclaimed scrap. Buy a 55' trailer with cash, fill it with stuff, then claim it belongs to the neighbors. Load material onto 30' racks and send the forklift operators home. It's almost better that your company committed to ISO to kinda get organized and then let it slide afterwards. I'd almost say it's worth it in a medium sized company every 10 years just to stay accountable and organized.
  - quickthrower2 7y ago
    It was all worth it for the line on her resume.
- eyegor 7y ago
  > I'm pretty sure ISO 9001 companies are audited every 4 years at their own expense Eh, kind of? I currently work for one and they haven't been audited in over a decade. The history goes: once upon a time, they were seeking certification because $potential_buyer asked about it. They failed the first audit quite miserably, and the next. By the third time, they squeezed by and were certified. The auditors came back 2 times in the next 2 years to make sure they were still compliant, and by the third year the auditors just asked if their processes had changed (without bothering to scrutinize everything again). They had not, and the auditors have not reached out ever since. The company is still certified. I think in theory they've "checked" since then but no one at the company can recall them actually showing up/auditing.
jacquesm 7y ago
Almost every certification is a recurring income generator for the certificating parties. Some are annual, others bi-annual or even longer periods between certifications but none that I am aware of are 'forever'.
- dmix 7y ago
  That makes sense. My goal in life is to never work for a company where that type of thing would be considered seriously.
  - jacquesm 7y ago
    So, the following are out: aerospace, fintech, medtech, insurance, anything requiring a login through a local account (not through some identity provider) and so on. You'd be surprised how many companies are now operating in territory where certification is either a hard requirement or where it will help them to ensure that they are good stewards of the data they hold.
dyu 7y ago
ISO27001 (the main security one) has annual reviews which are more lightweight. After two years, the three-year cycle restarts.