SharePoint to Support ISO Certification

Have any of you used WSS 3.0 to support ISO certification efforts?

We are starting the process to gain ISO certification and those in charge were looking at third party software, but I believe our new WSS site would more than fit the needs from a document management perspective.

I would just like to hear from people who may have used WSS for this purpose to get any tips or best practices. I know my way pretty well around WSS. I hold the Configuring and Developer certifications for MOSS 2007 so that side of my knowledge is fairly descent. But I have little knowledge of the ISO certification process in a manufacturing environment. Any advice would be quite welcome.

Thanks in advance!

Find more posts tagged with

SAVE $250 on Your Boot Camp — Use Code "EXAM26"

Exclusively for TechExams members for Infosec Boot Camps starting before April 30, 2026

View Boot Camps

Comments

vCole

I know that for ISO certs at my work, we ended up getting a third party application to better manage security for the ISO Certificate.

Not sure what the name of it was, but I will find out.

RobertKaucher

FadeToBright wrote: »

I know that for ISO certs at my work, we ended up getting a third party application to better manage security for the ISO Certificate.

Not sure what the name of it was, but I will find out.

bright, could you also tell me a little bit about how you use the software at work/ What it actually does for you, etc? That would be a major help as well. Thanks!

eMeS

Which ISO/IEC certification?

I have seen SharePoint used to do this, but it is definitely not an industrial strength document management solution. Another solution that I'm familiar with is a tool called "Archer" that helps ensure compliance, etc...

However, when achieving an ISO/IEC certification the organization is allowed to tell the auditor what their specific document management requirements are and how the processes and tools you've chosen meet those requirements.

In other words, an ISO/IEC auditor will never (should never) come into your organization and say that you must do document management "this specific way" or with "this specific tool" in order to achieve or maintain ISO/IEC certification.

Document management requirements are very industry and business specific. What is required for the pharmaceutical industry is very different from what is required in the computer manufacturing industry.

The real key is that you've considered the need for document management, you've come up with an answer that fits your business, and you can demonstrate two things to the auditor: 1) evidence of intent (that we thought about it and planned it), and 2) evidence of action (that we are actually doing what we planned). You will fail an ISO audit without both of those items.

A perfectly valid answer to document management requirements for ISO/IEC certification is "we thought about it, and here's our evidence of that, and decided that our business does not require formal document management." That will pass an ISO/IEC audit, however, I cannot think of a single organization interested in pursuing an ISO/IEC certification that can realistically come to this conclusion.

Bottom-line, your business requirements (not an arbitrary standard) dictate your document management requirements. That alone will determine if SharePoint is a sufficient solution. As far as "best practices go", I think many industries would find that they have to heavily customize SharePoint to meet their needs, from my standpoint, why incur this cost when a less expensive solution (to develop and maintain) can likely be purchased from one or more vendors?

MS

RobertKaucher

eMeS,

I thought I had already sent this reply... But I guess not.

What are the inadequacies you see in SharePoint for this purpose?

eMeS

RobertKaucher wrote: »

eMeS,

I thought I had already sent this reply... But I guess not.

What are the inadequacies you see in SharePoint for this purpose?

The document management requirements for achieving an ISO/IEC certification are directly driven by the requirements of your business. Without specifically understanding that, it would be difficult for me to provide my thoughts.

For many organizations, SharePoint will be sufficient. However, for at least as many it will not be. There are products in this space such as Documentum and Archer that provide very specific functionality. But again, you only spend the money if you need those type of solutions.

Most of my experience is in the financial service industry, where we had very specific requirements around document management. The tool we used was called Archer, which is definitely a niche product. In another organization that I did some ISO/IEC 20000 work with, they used SharePoint, but their business requirements for document management were really minimal, and this was a fit for them.

MS

RobertKaucher

Thansk, eMeS. Your input is informative as always!