Request for quotation for certification process of quality management system

check the relevant box *

organization in Israel

overseas organization

Please mark

New

Scope Extension

Extension Site / subsidiary

Change name & tax number

Organization details

Organization Name (in Hebrew) *

Registration company number / Authorized Dealer *

Organization address (in English) *

Invoice address (if different)

Organization Name (in English) *

Organization Address (in Hebrew) *

Address for letters *

Phone Number *

Website

Zip code

Email *

Name of General Manager *

Contact Person with SII *

Mobile Number - General Manager *

Mobile number *

Email - General Manager *

Email *

Already an SII customer (mark)?

If so: Customer number

Scope Extension

Adding site/ Subsidiary

Name changed & Registration company number

Other

please specify

Does your organization holds a valid certificate from another CB for the requested standard?

If yes: certifier body name

Certificate valid from

Certificate valid until

Copy of the certificate *

Attach No file chosen

Last audit date

Copy of last audit report include three year audit plan *

Attach No file chosen

Please specify the reason for asking transfer of certification: *

Price

Service

Other

No of employees *

Number of employees in each field, if applicable

Total number of employees in the organization *

Service

Procurement

Securing

Development

Cleaning

Production

Other

Does your organization employ subcontractors?

Yes

Please state their number *

Does the organization work in shifts? *

Yes

Please specify number of shifts *

Are the processes/ activities the same in each shift? *

Yes

Standards

Standard name

Additional information Relevant for ISMS according to ISO 27001

In this section, specify the total number of employees in the organization across all shifts and roles that are under the organization's control and within the certification scope and who have access to the organization's information systems .( Do not count employees who have no access to information systems and/or do not use the organization's systems) *

divide the No. into employee groups according to similar and/or identical activities. Each employee should be counted once according to their primary role. The sum of employees in the various groups must equal the total number of employees in the organization included in the certification.

divide the No. into employee groups according to similar and/or identical activities.
Each employee should be counted once according to their primary role. The sum of employees in the various groups must equal the total number of employees in the organization included in the certification.

System users in the organization (non-Admin/IT): All employees who use information systems as part of their work. Examples: Sales, Finance, Customer Service, Procurement, Operations, Human Resources, Management, etc.

System users in the organization (non-Admin/IT): All employees who use information systems as part of their work. Examples: Sales, Finance, Customer Service, Procurement, Operations, Human Resources, Management, etc.

Total system users *

IT employees: Employees responsible for operation, maintenance, development, or security of information systems and infrastructure. Examples: Help Desk, System, Communications, Developers, SOC, DBA, DevOps, Information Security, Network Administrators, Cloud Team, etc.

IT employees: Employees responsible for operation, maintenance, development, or security of information systems and infrastructure. Examples: Help Desk, System, Communications, Developers, SOC, DBA, DevOps, Information Security, Network Administrators, Cloud Team, etc.

Total IT employees *

System Administrators / Admins or Special privileges: Employees with administrative privileges or special access to critical systems. Examples: Domain Admin, System Admin, Database Admin, Cloud Admin, Security Admin, etc.:

System Administrators / Admins or Special privileges: Employees with administrative privileges or special access to critical systems. Examples: Domain Admin, System Admin, Database Admin, Cloud Admin, Security Admin, etc.:

Total System Administrators / Special Privilege Holders *

Please indicate if there are any items or documents containing confidential or sensitive information that cannot be made available to the audit team (e.g., any information related to the Information Security Management System (ISMS) and information concerning the design and effectiveness of controls). *

Yes

Please note that the organization is responsible to update the auditor regarding this subject.

Please note that the organization is responsible to update the auditor regarding this subject.

Please indicate whether the organization wishes to expand its scope of activity and/or add sites *

Yes

Type of extension required (e.g., adding a site / expanding scope) – please specify *

Number of sites/locations being added to the scope of activities (if applicable) – please specify *

As a result of the extension has there been any updates regarding risks affecting your organization's Information Security Management System (ISMS) : *

Yes

Number of controls that were updated due to the expansion of activities *

Please specify the number of employees relevant to the extension activities (at each site if relevant) *

Complexity of the Information Security Management System:

Complexity of the Information Security Management System: *

Little/no sensitive or confidential information and low availability requirements

Sensitive/confidential information exists and medium availability requirements

Large scope of sensitive or confidential information (e.g., medical, personally identifiable, insurance, or banking information) or high availability requirements

Critical assets, systems, databases, infrastructures *

Small (1–5)

Medium (6–15)

Large (15+)

Processes and services included in the ISMS *

One central process with few interfaces

2–3 central processes

More than 3 complex processes with multiple interfaces

Details *

Type of business activity and regulatory requirements within the ISMS scope:

Type of business activity and regulatory requirements within the ISMS scope: *

Low-risk activity with no significant regulatory requirements

High-risk activity with significant regulatory requirements (e.g., finance, insurance, healthcare, government, privacy, etc.).

Specify applicable legal, regulatory, and contractual requirements (e.g., Privacy Protection Law and Information Security Regulations, GDPR, Bank of Israel directives, HIPAA, PCI DSS, additional industry regulations) *

Information security system maturity:

Information security system maturity *

No certification and/or processes are not fully established

Certified to a standard and conducts audits

Complexity and technological diversity of the IT environment:

Complexity and technological diversity of the IT environment: *

Uniform and simple IT environment with few platforms/systems/networks

Standard IT environment with a moderate variety of platforms, servers, operating systems, and databases

Complex or highly diverse IT environment including multiple networks, servers, databases, and critical applications

Briefly specify key technologies and separate environments, if any *

Extent of outsourcing and dependency on suppliers within the ISMS scope:

Extent of outsourcing and dependency on suppliers within the ISMS scope *

No significant outsourcing or low supplier dependency

High dependency on suppliers / outsourcing affecting significant business activities

Specify significant suppliers and outsourced services included in the ISMS scope *

Extent of information systems development within the ISMS scope:

Extent of information systems development within the ISMS scope *

No information systems development in the organization

Use of standard platforms and systems

Significant internal or outsourced development activities, including several active critical projects

Briefly describe key development types and their scope *

The organization has multiple sites in Israel and abroad and disaster recovery (DR) sites and requests that they be listed on the certificate:

The organization has multiple sites in Israel and abroad and disaster recovery (DR) sites and requests that they be listed on the certificate *

Single site / up to one DR site with low availability requirements

One or more sites / up to one DR site with medium or high availability requirements

Multiple data centers and DR sites

Details *

Number and complexity of ISMS controls:

Number and complexity of ISMS controls *

Limited number of controls, with key control areas not covered

Standard number and complexity of controls according to ISMS requirements

Large number of detailed and complex controls (e.g., network controls, encryption, advanced system security)

Briefly specify key control areas and exceptions, if any *

Use of cloud services:

The organization uses critical cloud services supporting activities within the certification scope (IaaS / PaaS / SaaS) *

Yes

Specify the service type and level of dependency (low / medium / high). No need to specify cloud services used for activities outside the certification scope *

Scope of changes in the ISMS since the last surveillance audit / recertification:

Scope of changes in the ISMS since the last surveillance audit / recertification *

No changes

Significant changes in the ISMS and influencing factors

Details *

Readiness for remote audits and virtual/temporary sites:

There are virtual sites or online work environments that employees connect to regardless of physical location *

Yes

Specify virtual sites and types of online environments, if any *

Communication infrastructure available for remote auditing (video, screen sharing, controlled system access) *

Yes

Specify available communication/sharing tools for remote verification of processes and controls *

The organization's activity include temporary sites( projects, installations, customer sites) *

Yes

Details *

Existing certifications and approvals:

Does the organization hold another ISO management system certificate (e.g., ISO 9001) *

Yes

Specify previous certifications or third-party reviews (previous ISO 27001, HITRUST, SOC 2, regulatory audit, etc.): certification body, last audit date, and significant findings: *

Attach another ISO management system certificate file *

Attach No file chosen

Describe your organization

(Services, business processes, the sensitive information in use) *

Additional information Relevant for standard ISO 27701

The organization holds a valid ISMS certification? *

Yes

Valid until *

Does the organization hold certification to other management system standards, or request a combined audit with the PIMS? *

Yes

Please specify the standards and the certification bodies *

Please specify the total number of people doing work under the organization's control for all shifts within the scope of certification: *

Info

Lines A to E divide this total according to each person's level of access to the organization's information processing facilities within the scope of the PIMS. Every person belongs to one line only, and A+B+C+D+E must equal the total. Example- an organization of 40 persons could report A=12, B=8, C=5, D=0, E=15 (total 40), and F=9

A. No' of people with read-only access to information to perform their duties. *

B. No' of people with no access to the organization's information processing facilities in scope of the PIMS *

C. No' of people who have specific demonstrable restricted access to the company's information processing facilities in scope of the PIMS *

D. No' of people who perform activities where strict limitations are implemented to restrict disclosure of information *

E. All other people- people with full access to the organization's information processing facilities in scope of the PIMS *

Check: A+B+C+D+E must equal the total number of persons above *

F. Of the total above, how many people process PII, or have access to PII, within the scope of the PIMS? *

No' of shifts within the scope of certification, and whether the same processes are performed in each shift *

Same processes in each shift? *

Yes

Please identify the organization's role in accordance with applicable privacy regulations and ISO 27701 definitions *

PII Controller

PII Processor

Both

Does the scope of certification include processing of sensitive, special category, financial, HR-related, pseudonymized, or otherwise high-risk PII, including processing activities requiring a DPIA or equivalent privacy assessment *

Yes

Please specify: *

Does the scope of certification include the transfer of PII across different jurisdictions or geographies, including transfers controlled through binding corporate rules, contractual mechanisms, inter-company arrangements, or encryption *

Yes

Please specify: *

Does the scope of certification include complex PII processing activities such as profiling, data mining, or processing subjects to multiple privacy, legal, or sector-specific regulatory requirements *

Yes

Please specify: *

Does the scope of certification include multiple PII processing activities *

Yes

Please specify: *

Does the organization implement a substantial portion of the ISO 27701 controls within the scope of certification *

Yes

Please specify an estimated implementation level or percentage *

Does the organization operate across multiple locations and/or jurisdictions within the scope of certification *

Yes

Please specify the number of locations or jurisdictions/geographies *

Does the organization process a high volume of PII records within the scope of certification *

Yes

Please indicate the approximate number of PII records processed *

Does the scope of certification include the processing of PII across multiple IT platforms or systems *

Yes

Please indicate the approximate number of platforms used for PII processing *

Appendix for quotation for ISO 45001 standard

Name of director of safety and health in employment in the organization *

Email *

Mobile Phone *

Is there a safety supervisor in the organization

Yes

Name *

The scope of his job

Initial assessment of key risk factors in the organization (for each of the areas, specify the departments / processes)

Work in heights *

Chemical hazards *

Noise *

Other

Mechanical hazards *

Fire *

electrical power *

Self-assessment of the readiness of the organization's safety and health management system in employment:

Is there a safety management plan in place?

Yes

If so, please specify: *

Is a risk survey conducted / conducted?

Yes

If so, please specify: *

Is there safety equipment?

Yes

If so, please specify: *

Are internal audits conducted and documented?

Yes

If so, please specify: *

Does the organization use hazardous materials?

Yes

If so, please specify: *

Does the organization have a business license? What's the attacker? *

Yes

If so, please specify: *

Does the organization have a toxin permit ? *

Yes

If so, please specify: *

Additional information Relevant for ISO 14001

Environmental Quality Management System Manager: *

Mobile Number: *

Email: *

Preliminary assessment of organizational factors affecting the environment

For each environmental impact area, check the impact attribute if available

In each field, mark the impact attribute if any

Air

Chimney / Stack / Vent

fugitive emission

Dust

Ground

area suspected of being contaminated / polluted.

underground tanks

Water - Surface current / Surface runoff

Creek, dry riverbed passing through the organization.

Rain drainage system

Water - Wastewater

Pre-treatment facility

Industrial sewage

Water - Groundwater

Well

Soil testing drilling

Self-assessment of the readiness of the organization's environmental management system

Is there an environmental monitoring system?

Yes

If so, please specify: *

Has an environmental aspect survey been conducted?

Yes

If so, please specify: *

Are environmental emissions events recorded?

Yes

If so, please specify: *

Is there an emergency plan in the event of an environmental pollution event?

Yes

If so, please specify: *

Are internal environmental audits conducted and documented?

Yes

If so, please specify: *

Does the organization use hazardous materials?

Yes

If so, please specify: *

Does the organization have a business license?

Yes

If so, please specify: *

Does the organization have a poison permit?

Yes

If so, please specify: *

Is the organization close to a nature reserve? \ N (Water Resources, Historic Value Areas)

Yes

If so, please specify: *

information Relevant for ISO 13485

No. of employees relevant to the standard: *

Does your organization carry out installations in a customer's home? *

Yes

If so please specify: *

Does your organization and products meet all applicable legal and regulatory requirements relevant to product quality and safety? *

Yes

If so please specify: *

Do you have a large number of shifts / production lines in your organization? *

Yes

If so please specify: *

Does your organization's field of activity (Scope) include manufacturing? *

Yes

Does your organization operate in the field of wholesale sales, retail, transportation or maintenance of equipment? *

Yes

Does your organization carry out design and development activities? *

Yes

Are you a client of the Standards Institute of Israel and / or have additional qualifications for implementing quality systems, such as ISO 9001? *

Yes

If so please specify: *

Do you have a large number of employees doing similar work or are outside the organization? *

Yes

If so please specify: *

If your organization carry out manufacturing or development scope? *

Yes

What is the level of risk (Class) of your organization's products (A, B, C, or D)? *

If your organization use subcontractors for the following processes : Production, assembly or packaging of the product, Development, Production of critical components in the product *

Yes

The organization products is in stage ? *

Development stage

Clinical / commercial trials (product in use)

Does your organization's subcontractor have an ISO 13485 certificate? *

Yes

Does your organization conduct audits at subcontractor ? *

Yes

Does the product needed energy (Active)? *

Yes

information Relevant for ISO 50001

General Energy Consumption [in Tera-Joules] *

Number directly engaged in the energy system and the energy management system *

for example

[For example: technical agents, operators, procurement and administration, decision makers and policy makers in the energy field].

Is there an Energy supervisor ? *

Yes

Name *

Email *

Mobile Number *

Energy sources

Please specify energy sources *

Electricity

Diesel

Gas

Fuel

steam

Solar energy

Additional information Relevant for FSMS according to ISO 22000

Is the organization a part of a different entity? *

Yes

If yes, Please provide detailes *

Does any legal requirements apply to your product(s) ? *

Yes

If yes, Please provide detailes *

Does the organization operates seasonaly or have seasonal products? *

Yes

If yes, Please provide detailes *

Please provide general information about your organization (English): *

Information concerning process lines and HACCP studies :

Detail the main process line – in the technological level

First process line *

Another process line (second)

second process line *

Another process line (Third)

Third process line *

Another process line (fourth)

Fourth process line *

Another process line (fifth)

Fifth process line *

Please detale the noumber of haccap staudies that releted to the requested cedrtification scope *

Additional information Relevant for ISO 22301

Name of BC manager *

Phone Number *

Email *

Organization management (steering committee, managers)

Number of personnel *