1. Günter Griesmayr 29. April 2010
K-A
AMA Quality Management System (QMS) and Information Security Management System (ISMS)
Günter Griesmayr
29. April 2010

2. Agrarmarkt Austria
Austrian Paying Agency for CAP (everything but export refunds)
AMA was founded 1993 by law
1st and 2nd Pillar of CAP
~ 500 employees
2009: payment of Mio. EUR

3. Organisation Chart

4. 1. Relation Reg. 885/2006 and ISO Standards
Framework for the improvement of the implementation of EU requirements under Reg 1663/95
1996 decision for the implementation of ISO 9001
1997 start of the preparation for certification
1999 first certification, since then certified
2005: Reg 465/2005 – new Information Security requirements (ISO 27002, COBIT, Baseline Protection Manual)
decision for ISO 27002
certification 2007, since then certified

5. 1. Relation Reg. 885/2006 and ISO Standards
Connections of ISO Standards with Reg 885/2006 Annex I

6. 2. ISO 9001:2008 / ISO 27001:2005 (1) certification:
The certificate confirms that the organisation has an established, implemented and maintained quality and information security management system.
The AMA was certified by Quality Austria (ISO 9001) and CIS (ISO 27001).
These ISO-Systems are nearly worldwide accepted.

7. 2. ISO 9001:2008 / ISO 27001:2005 (2)
The ISO 9001 certificate relates to the quality of the organisation.
The ISO certificate confirms the security management (incl. risk management) regarding human resources, physical and environmental security , IT systems, IT stored data and not electronicly stored data.

8. 2. ISO 9001:2008 / ISO 27001:2005 (3) requirements:
Management responsibilities
customer relationship, quality and security policy and targets, responsibilities, competence and communication, management commitment
Resource Management
human resources, infrastructure, work environment, budget
Documentation
management manual, controlled and classified documents and records,...
Risk management

9. 3. Internal audit ISO 9001 und ISO 27001 (1)
purpose:
check compliance with internal regulations and ISO-requirements
check compliance of documentation with processes
check effectiveness and efficiency of the management system
planning:
audit programme for 3 years, internal audits of all divisions and locations
regard results of passed internal audits
define audit method (system or process) and focus
fix auditors

10. 3. Internal audits ISO 9001 und ISO 27001 (2)
schedule:
preliminary talk
check documentation
audit
closing talk
reporting
continual improvement
results of audits run in the process of continual improvement. There controls are fixed and the effectiveness will be checked and documented.

11. 4. External audits ISO 9001 und ISO 27001
certification audit
Once by accredited certification body (Quality Austria – ISO 9001, Certification & Information Security Services GmbH – ISO 27001)
surveillance audit
yearly
accredited certification body
recertification audit
every three years
certificate extension

12. 5. benefits of QMS and ISMS (1)
accreditation as paying agency
continued systematic update
controllable clear processes
transparency and traceability of operations
transparent and clear responsibilities
secure decisions / clear duties
clear competence and interfaces
intensification of communication
focused resource management
standardization if usefull
easier handling because of standardization, clear processes and responsibility

13. 5. benefits of QMS and ISMS (2)
higher efficiency
systematic error prevention
internal control system
trained employees
security / liability
better image
identification and treatment of risks
business continuity management
clear rules for information security