CWA 15374:2005
(Main)Security Management System for suppliers to secure printing industry
Security Management System for suppliers to secure printing industry
This CWA specifies requirements for a security management system according to which an organisation or company:
a) Needs to demonstrate its ability to consistently provide products that meet security requirements set by law and regulations, requirements from the Secure Printing Industry and customers, and provisions of the risk inventory.
b) Aims to enhance customer satisfaction through the effective application of the security management system, including processes for continual improvement of the system and the conformity to security requirements set by law and regulations, requirements from and customers, and results of the risk inventory.
Sistem upravljanja varnosti za dobavitelje varne tiskarske industrije
Ta CWA določa zahteve za sistem upravljanja varnosti, v skladu s katerim naj bi v organizaciji ali podjetju:
- dokazali svojo sposobnost, da dosledno zagotavljajo izdelke, ki izpolnjujejo varnostne zahteve, določene z zakonom in predpisi, zahteve varne tiskarske industrije in strank ter določbe popisa tveganja.
- poskušali povečati zadovoljstvo strank z učinkovito uporabo sistema upravljanja varnosti, vključno s postopki za nenehno izboljševanje sistema in skladnostjo z varnostnimi zahtevami, ki jih določa zakon in predpisi, zahteve strank in rezultati popisa tveganj.
General Information
Standards Content (Sample)
SLOVENSKI STANDARD
01-april-2016
Sistem upravljanja varnosti za dobavitelje varne tiskarske industrije
Security Management System for suppliers to secure printing industry
Ta slovenski standard je istoveten z: CWA 15374:2005
ICS:
37.100.01 *UDILþQDWHKQRORJLMDQD Graphic technology in
VSORãQR general
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
CEN
CWA 15374
WORKSHOP
August 2005
AGREEMENT
ICS 37.100.01
English version
Security Management System for suppliers to secure printing
industry
This CEN Workshop Agreement has been drafted and approved by a Workshop of representatives of interested parties, the constitution of
which is indicated in the foreword of this Workshop Agreement.
The formal process followed by the Workshop in the development of this Workshop Agreement has been endorsed by the National
Members of CEN but neither the National Members of CEN nor the CEN Management Centre can be held accountable for the technical
content of this CEN Workshop Agreement or possible conflicts with standards or legislation.
This CEN Workshop Agreement can in no way be held as being an official standard developed by CEN and its Members.
This CEN Workshop Agreement is publicly available as a reference document from the CEN Members National Standard Bodies.
CEN members are the national standards bodies of Austria, Belgium, Cyprus, Czech Republic, Denmark, Estonia, Finland, France,
Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Slovakia,
Slovenia, Spain, Sweden, Switzerland and United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION
EUROPÄISCHES KOMITEE FÜR NORMUNG
Management Centre: rue de Stassart, 36 B-1050 Brussels
© 2005 CEN All rights of exploitation in any form and by any means reserved worldwide for CEN national Members.
Ref. No.:CWA 15374:2005 E
Contents
Foreword . 3
0 Introduction. 4
0.1 General . 4
0.2 Process approach . 4
0.3 Basic principles . 5
1 Scope . 6
1.1 General . 6
1.2 Application. 6
2 Normative Reference. 6
3 Terms and definitions . 6
4 Security management system. 8
4.1 General Requirements . 8
4.2 Documentation requirements . 8
5 Management responsibility . 9
5.1 Management commitment. 9
5.2 Customer focus . 10
5.3 Security policy . 10
5.4 Planning . 10
5.5 Responsibility, authority and communication. 10
5.6 Management review. 11
6 Resource management . 11
6.1 Provision of resources. 11
6.2 Human resources. 12
6.3 Infrastructure. 12
6.4 Work environment . 12
7 Product Realization Requirements . 12
7.1 Planning of product realization . 12
7.2 Customer-related processes . 13
7.3 Design and development inputs . 14
7.4 Purchasing . 14
7.5 Production and service provision. 15
7.6 Control of monitoring and measuring devices. 16
8 Measurement, analysis and improvement requirements. 16
8.1 General . 16
8.2 Monitoring and measurement. 17
8.3 Control of non-conforming product . 18
8.4 Analysis of data. 18
8.5 Improvement . 18
Foreword
The formal process followed by the Workshop in the development of the CEN Workshop Agreement
has been endorsed by the National Members of CEN but neither the National Members of CEN nor
the CEN Management Centre can be held accountable for the technical content of the CEN Workshop
Agreement or possible conflict with standards or legislation. This CEN Workshop Agreement can in no
way be held as being an official standard developed by CEN and it’s members.
The date of acceptance for this document was 14 June 2005.
This CEN Workshop Agreement is publicly available as a reference document from the National
Members of CEN: AENOR, AFNOR, BSI, CSNI, CYS, DIN, DS, ELOT, EVS, IBN, IPQ, IST,
LVS, LST, MSA, MSZT, NEN, NSAI, ON, PKN, SEE, SIS, SIST, SFS, SN, SNV, SUTN and
UNI.
Comments or suggestions from the users of the CEN Workshop Agreement are welcome and should
be addressed to the CEN Management Centre.
0 Introduction
0.1 General
The quality of products and services is one of the leading criteria for assessing the extent to which the
transactions and operation of a certain (corporate) organisation or company correspond to the desired
goals. For producers of secured materials, special machinery or special services for security printers
however, the quality requirements for the processes and products are not sufficient: the processes
and products/services must be produced, managed and delivered under safe conditions in all stages
of production (from the initial contact with the possible customer to the aftercare that may be required
after the delivery) in order to meet the requirements of the customers. Technical requirements alone
no longer provide sufficient guarantees that the requirements set by the customers will be
continuously observed. Due to the lack of technical specification, but also to possible deficiencies
within an organisation or company, discrepancies with the requirements set by the customer may
occur.
The adoption of a security management system should be a strategic decision of an organisation or
company. The design and implementation of an organisation or company’s security management
system is influenced by varying needs, particular objectives, products provided, processes employed
and by the size and the structure of the organisation or company.
It is not the intent of this CWA to imply uniformity in the structure of the security management system
or uniformity of documentation.
To achieve the product and process security objectives for an organisation or company, the technical,
administrative and human factors that have an influence on the aforementioned security must be
effectively controlled. Such control must be geared to reducing, eliminating and above all preventing
discrepancies.
The CWA is intended to apply to all sorts of suppliers to graphical companies, irrespective of their
scope. The CWA contains requirements that can be objectively audited for certification / registration
purposes.
Certification is only possible, if the organisation or company has established a security management
system that complies with the provisions described in the risk inventory. Furthermore the security
management system has to comply with laws and regulations in force and with additional specific
requirements from the customer.
The security management system requirements specified in this CWA are complementary to
requirements for products. Information marked “ Remark” is for guidance in understanding or clarifying
the associated requirement.
Conformity to this CWA also requires compliance with two restricted documents:
� Risk Inventory
� Guideline for implementation.
For security and confidentiality reasons these restricted documents will only be supplied to appropriate
parties upon justification of their quality supported by client and bank references, legal status and
financial status. For certification organisations a specific procedure to follow has been established.
The restricted documents are owned by Intergraf, International Confederation for Printing and Allied
Industries a.i.s.b.l., Brussels. More information about the procedures can be found on the website of
Intergraf or by contacting the Intergraf offices in Brussels.
0.2 Process approach
This CWA promotes the adoption of a process approach when developing, implementing, and
improving the effectiveness of a security management system, to enhance customer satisfaction by
meeting security requirements of the customer.
To function effectively an organisation or company has to identify and manage numerous linked
activities. An activity using resources, and managed in order to enable the transformation of inputs into
outputs, can be considered as a process. Often the output from one process directly forms the input to
the next.
The application of a system of processes within an organisation or company, together with the
identification and interaction of these processes, and their management, can be referred to as a
“process approach”.
An advantage of a “process approach” is the ongoing control that it provides over the linkage between
individual processes within the system of processes, as well as over their combination and interaction.
When used within a security management system, such an approach emphasizes the importance of:
a) understanding and meeting security requirements;
b) the need to consider processes in terms of added value;
c) obtaining results of security performance and effectiveness; and
d) continual improvement of the security based on objective measurement.
0.3 Basic principles
The organisation or company must endeavour to attain the following security objectives:
• The organisation or company must attain the security of products, processes, premises,
information, etc. and use it to continue to meet demonstrably the requirements, and naturally, the
needs of customers.
• The organisation or company must give its own management the confidence that the targeted
degree of security is actually achieved and remains up to par.
• The organisation or company must give the customers the confidence that the agreed nature and
degree of security is or will be attained. If contractually required, this can entail that requirements
are agreed on demonstrating justification for this confidence.
The 'Security Management System' is based on the quality standard ISO 9001:2000 on the following
grounds:
• The systematic methods of the ISO 9001:2000 (according to the Plan, Do, Check and Act –
Deming circle) is adopted, which entails, inter alia, that the management is demonstrably prepared
and capable of learning from experience so as to be able to manage, guarantee and improve
security;
• The CWA prescribes which elements a security management system contains and not how a
specific organisation or company implements these elements. The specific situation within
companies alway
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.