iTeh StandardsiTeh Standards
EURUSD
Your shopping cart is empty.
CEN

EN ISO/IEC 27006-1:2024

(Main)

Information security, cybersecurity and privacy protection - Requirements for bodies providing audit and certification of information security management systems - Part 1: General (ISO/IEC 27006-1:2024)

Information security, cybersecurity and privacy protection - Requirements for bodies providing audit and certification of information security management systems - Part 1: General (ISO/IEC 27006-1:2024)

This document specifies requirements and provides guidance for bodies providing audit and certification of an information security management system (ISMS), in addition to the requirements contained within ISO/IEC 17021-1.
The requirements contained in this document are demonstrated in terms of competence and reliability by bodies providing ISMS certification. The guidance contained in this document provides additional interpretation of these requirements for bodies providing ISMS certification.
NOTE       This document can be used as a criteria document for accreditation, peer assessment or other audit processes.

Cybersicherheit und Datenschutz - Anforderungen an Stellen, die Informationssicherheitsmanagementsysteme auditieren und zertifizieren - Teil 1: Allgemeines (ISO/IEC 27006-1:2024)

Dieses Dokument legt Anforderungen fest und bietet Anleitung für Stellen, die Audits und Zertifizierungen von Informationssicherheitsmanagementsystemen (ISMS) vornehmen. Zusätzlich gelten die Anforderungen nach ISO/IEC17021-1.
Die in diesem Dokument enthaltenen Anforderungen werden von Stellen, die ISMS-Zertifizierungen durch
führen, im Hinblick auf Kompetenz und Zuverlässigkeit nachgewiesen. Die in diesem Dokument enthaltene Anleitung bietet eine zusätzliche Interpretation dieser Anforderungen für Stellen, die ISMS-Zertifizierungen durchführen.
ANMERKUNG Dieses Dokument kann als Kriteriendokument für die Akkreditierung, die Bewertung unter Gleichrangi
gen oder für andere Auditprozesse verwendet werden.

Sécurité de l'information, cybersécurité et protection de la vie privée - Exigences pour les organismes procédant à l'audit et à la certification des systèmes de management de la sécurité de l'information - Partie 1: Généralités (ISO/IEC 27006-1:2024)

Le présent document spécifie les exigences et fournit des recommandations pour les organismes procédant à l'audit et à la certification d'un système de management de la sécurité de l'information (SMSI), en plus des exigences contenues dans l'ISO/IEC 17021‑1.
Les organismes qui procèdent à la certification de systèmes ISMS démontrent qu'ils respectent les exigences de compétence et de fiabilité présentées dans le présent document. Les recommandations contenues dans le présent document fournissent une interprétation supplémentaire de ces exigences pour les organismes procédant à la certification de systèmes ISMS.
NOTE       Le présent document peut être utilisé comme référentiel pour l'accréditation, l'évaluation par des pairs ou d'autres processus d'audit.

Zahteve za organe, ki izvajajo presojanje in certificiranje sistemov upravljanja informacijske varnosti - 1. del: Splošno (ISO/IEC 27006-1:2024)

General Information

Status
Published
Publication Date
12-Mar-2024
ICS
03.120.20 - Product and company certification. Conformity assessment
35.030 - IT Security
Technical Committee
CEN/CLC/TC 13 - Cybersecurity and Data Protection
Drafting Committee
CEN/CLC/TC 13 - Cybersecurity and Data Protection
Current Stage
6060 - Definitive text made available (DAV) - Publishing
Start Date
13-Mar-2024
Completion Date
13-Mar-2024
Ref Project
SIST EN ISO/IEC 27006-1:2024 - Requirements for bodies providing audit and certification of information security management systems - Part 1: General (ISO/IEC 27006-1:2024)

Relations

Replaces
EN ISO/IEC 27006:2020 - Information technology - Security techniques - Requirements for bodies providing audit and certification of information security management systems (ISO/IEC 27006:2015, including Amd 1:2020)
Effective Date
18-Mar-2024

Buy Standard

prEN ISO/IEC 27006-1:2022prEN ISO/IEC 27006-1:2022
PreviousNext
Draft
prEN ISO/IEC 27006-1:2022
English language
57 pages
sale 10% off
Preview
sale 10% off
Preview
e-Library read for
1 day

Standards Content (Sample)

SLOVENSKI STANDARD
oSIST prEN ISO/IEC 27006-1:2022
01-september-2022
Zahteve za organe, ki izvajajo presojanje in certificiranje sistemov upravljanja
informacijske varnosti - 1. del: Splošno (ISO/IEC/DIS 27006-1:2022)
Requirements for bodies providing audit and certification of information security
management systems - Part 1: General (ISO/IEC/DIS 27006-1:2022)
Anforderungen an Stellen, die Informationssicherheitsmanagementsysteme auditieren
und zertifizieren - Teil 1: Allgemeines (ISO/IEC/DIS 27006-1:2022)
Exigences pour les organismes procédant à l'audit et à la certification des systèmes de
management de la sécurité de l'information - Partie 1: Généralités (ISO/IEC/DIS 27006-
1:2022)
Ta slovenski standard je istoveten z: prEN ISO/IEC 27006-1
ICS:
03.120.20 Certificiranje proizvodov in Product and company
podjetij. Ugotavljanje certification. Conformity
skladnosti assessment
35.030 Informacijska varnost IT Security
oSIST prEN ISO/IEC 27006-1:2022 en,fr,de
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

---------------------- Page: 1 ----------------------
oSIST prEN ISO/IEC 27006-1:2022

---------------------- Page: 2 ----------------------
oSIST prEN ISO/IEC 27006-1:2022
DRAFT INTERNATIONAL STANDARD
ISO/IEC DIS 27006-1
ISO/IEC JTC 1/SC 27 Secretariat: DIN
Voting begins on: Voting terminates on:
2022-07-01 2022-09-23
Requirements for bodies providing audit and certification
of information security management systems —
Part 1:
General
ICS: 35.030; 03.120.20
This document is circulated as received from the committee secretariat.
THIS DOCUMENT IS A DRAFT CIRCULATED
FOR COMMENT AND APPROVAL. IT IS
ISO/CEN PARALLEL PROCESSING
THEREFORE SUBJECT TO CHANGE AND MAY
NOT BE REFERRED TO AS AN INTERNATIONAL
STANDARD UNTIL PUBLISHED AS SUCH.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL,
TECHNOLOGICAL, COMMERCIAL AND
USER PURPOSES, DRAFT INTERNATIONAL
STANDARDS MAY ON OCCASION HAVE TO
BE CONSIDERED IN THE LIGHT OF THEIR
POTENTIAL TO BECOME STANDARDS TO
WHICH REFERENCE MAY BE MADE IN
Reference number
NATIONAL REGULATIONS.
ISO/IEC DIS 27006-1:2022(E)
RECIPIENTS OF THIS DRAFT ARE INVITED
TO SUBMIT, WITH THEIR COMMENTS,
NOTIFICATION OF ANY RELEVANT PATENT
RIGHTS OF WHICH THEY ARE AWARE AND TO
PROVIDE SUPPORTING DOCUMENTATION. © ISO/IEC 2022

---------------------- Page: 3 ----------------------
oSIST prEN ISO/IEC 27006-1:2022
ISO/IEC DIS 27006-1:2022(E)
DRAFT INTERNATIONAL STANDARD
ISO/IEC DIS 27006-1
ISO/IEC JTC 1/SC 27 Secretariat: DIN
Voting begins on: Voting terminates on:

Requirements for bodies providing audit and certification
of information security management systems —
Part 1:
General
ICS: 35.030; 03.120.20
This document is circulated as received from the committee secretariat.
COPYRIGHT PROTECTED DOCUMENT
THIS DOCUMENT IS A DRAFT CIRCULATED
FOR COMMENT AND APPROVAL. IT IS
© ISO/IEC 2022
ISO/CEN PARALLEL PROCESSING
THEREFORE SUBJECT TO CHANGE AND MAY
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
NOT BE REFERRED TO AS AN INTERNATIONAL
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on STANDARD UNTIL PUBLISHED AS SUCH.
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
IN ADDITION TO THEIR EVALUATION AS
or ISO’s member body in the country of the requester. BEING ACCEPTABLE FOR INDUSTRIAL,
TECHNOLOGICAL, COMMERCIAL AND
ISO copyright office
USER PURPOSES, DRAFT INTERNATIONAL
CP 401 • Ch. de Blandonnet 8
STANDARDS MAY ON OCCASION HAVE TO
BE CONSIDERED IN THE LIGHT OF THEIR
CH-1214 Vernier, Geneva
POTENTIAL TO BECOME STANDARDS TO
Phone: +41 22 749 01 11
WHICH REFERENCE MAY BE MADE IN
Reference number
Email: copyright@iso.org
NATIONAL REGULATIONS.
Website: www.iso.org ISO/IEC DIS 27006-1:2022(E)
RECIPIENTS OF THIS DRAFT ARE INVITED
Published in Switzerland
TO SUBMIT, WITH THEIR COMMENTS,
NOTIFICATION OF ANY RELEVANT PATENT
RIGHTS OF WHICH THEY ARE AWARE AND TO
ii
  © ISO/IEC 2022 – All rights reserved
PROVIDE SUPPORTING DOCUMENTATION. © ISO/IEC 2022

---------------------- Page: 4 ----------------------
oSIST prEN ISO/IEC 27006-1:2022
ISO/IEC DIS 27006-1:2022(E)
Contents Page
Foreword .v
Introduction . vi
1 Scope .
...

Questions, Comments and Discussion

Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.

This May Also Interest You

CEN
CEN ISO/IEC/TS 27006-2:2022(Main)
Requirements for bodies providing audit and certification of information security management systems - Part 2: Privacy information management systems (ISO/IEC TS 27006-2:2021)
SIST-TS CEN ISO/IEC/TS 27006-2:2023

This document specifies requirements and provides guidance for bodies providing audit and certification of a privacy information management system (PIMS) according to ISO/IEC 27701 in combination with ISO/IEC 27001, in addition to the requirements contained within ISO/IEC 27006 and ISO/IEC 27701. It is primarily intended to support the accreditation of certification bodies providing PIMS certification.
The requirements contained in this document need to be demonstrated in terms of competence and reliability by anybody providing PIMS certification, and the guidance contained in this document provides additional interpretation of these requirements for any body providing PIMS certification.
NOTE     This document can be used as a criteria document for accreditation, peer assessment or other audit processes.

  • Technical specification
    18 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
EN ISO/IEC 27007:2022(Main)
Information security, cybersecurity and privacy protection - Guidelines for information security management systems auditing (ISO/IEC 27007:2020)
SIST EN ISO/IEC 27007:2022

ISO/IEC 27007 provides guidance on managing an information security management system (ISMS) audit programme, on conducting audits, and on the competence of ISMS auditors, in addition to the guidance contained in ISO 19011:2011.
ISO/IEC 27007 is applicable to those needing to understand or conduct internal or external audits of an ISMS or to manage an ISMS audit programme.

  • Standard
    48 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
prEN ISO/IEC 27006-2(Main)
Requirements for bodies providing audit and certification of information security management systems - Part 2: Privacy information management systems (ISO/IEC/DIS 27006‑2:2023)
oSIST prEN ISO/IEC 27006-2:2023

This document specifies requirements and provides guidance for bodies providing audit and certification of a privacy information management system (PIMS) according to ISO/IEC 27701 in combination with ISO/IEC 27001, in addition to the requirements contained within ISO/IEC 27006 and ISO/IEC 27701. It is primarily intended to support the accreditation of certification bodies providing PIMS certification.
The requirements contained in this document need to be demonstrated in terms of competence and reliability by anybody providing PIMS certification, and the guidance contained in this document provides additional interpretation of these requirements for any body providing PIMS certification.
NOTE This document can be used as a criteria document for accreditation, peer assessment or other audit processes.

  • Draft
    24 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
CEN ISO/IEC/TS 27006-2:2022(Main)
Requirements for bodies providing audit and certification of information security management systems - Part 2: Privacy information management systems (ISO/IEC TS 27006-2:2021)
SIST-TS CEN ISO/IEC/TS 27006-2:2023

This document specifies requirements and provides guidance for bodies providing audit and certification of a privacy information management system (PIMS) according to ISO/IEC 27701 in combination with ISO/IEC 27001, in addition to the requirements contained within ISO/IEC 27006 and ISO/IEC 27701. It is primarily intended to support the accreditation of certification bodies providing PIMS certification.
The requirements contained in this document need to be demonstrated in terms of competence and reliability by anybody providing PIMS certification, and the guidance contained in this document provides additional interpretation of these requirements for any body providing PIMS certification.
NOTE     This document can be used as a criteria document for accreditation, peer assessment or other audit processes.

  • Technical specification
    18 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
EN ISO/IEC 27007:2022(Main)
Information security, cybersecurity and privacy protection - Guidelines for information security management systems auditing (ISO/IEC 27007:2020)
SIST EN ISO/IEC 27007:2022

ISO/IEC 27007 provides guidance on managing an information security management system (ISMS) audit programme, on conducting audits, and on the competence of ISMS auditors, in addition to the guidance contained in ISO 19011:2011.
ISO/IEC 27007 is applicable to those needing to understand or conduct internal or external audits of an ISMS or to manage an ISMS audit programme.

  • Standard
    48 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
CEN/TS 419261:2015(Main)
Security requirements for trustworthy systems managing certificates and time-stamps
SIST-TS CEN/TS 419261:2015

1.1   General
This Technical Specification establishes security requirements for TWSs that can be used by a TSP in order to issue QCs and Non-Qualified Certificates (NQCs) as well as electronic time-stamps in accordance with Dir.1999/93/EC and with [Reg.910/2014/EU].
Security requirements for the Subject Device Provision Service, which includes SCDev/QSCD provision to subjects, are defined in this TS. However, requirements specific to SCDev/QSCD devices, as used by subjects of the TSP, are outside the scope of this TS. These requirements are defined as Common Criteria [CC] Protection Profiles (PP) in the EN 419211 series.
Recommendations for the cryptographic algorithms to be supported by TWSs are provided in ETSI/TS 119 312.
Although this TS is based on the use of public key cryptography, it does not require or define any particular communication protocol or format for electronic signatures, certificates, certificate revocation lists, certificate status information and time-stamp tokens. It only assumes certain types of information to be present in the certificates in accordance with Annex I of Dir.1999/93/EC and of [Reg.910/2014/EU]. Interoperability between TSP systems and subject systems is outside the scope of this document.
The use of TWSs that are already compliant to relevant security requirements of this TS should support TSPs in reducing their burden to establish conformance of their policy to ETSI TS 119 411-1, 119 411-2, and 119 421 (or equivalent ENs to be subsequently published) and in meeting the Annex I and Annex II requirements of Dir.1999/93/EC as well as the requirements from Annex I and Article 24.2 (e) of [Reg.910/2014/EU].
1.2   European Regulation-specific
The main focus of this document is on the requirements in Article 24.2 (e) of [Reg.910/2014/EU] whilst still facilitating the meeting of requirements in Dir.1999/93/EC, Annex II (f). In considering [Reg.910/2014/EU] it is important to take into account the following requirements of particular relevance to TSP trustworthy systems:
a)   Article 24.2 (f) – “use trustworthy systems to store data provided to it, in a verifiable form so that:
(i)   they are publicly available for retrieval only where the consent of the person to whom the data relates has been obtained,
(ii)   only authorised persons can make entries and changes to the stored data,
(iii)   the data can be checked for authenticity”;
b)   Article 24.2 (g) – “take appropriate measures against forgery and theft of data”;
c)   Article 24.2 (h) – “record and keep accessible for an appropriate period of time, including after the activities of the qualified trust service provider have ceased, all relevant information concerning data issued and received by the qualified trust service provider, in particular, for the purpose of providing evidence in legal proceedings and for the purpose of ensuring continuity of the service. Such recording may be done electronically”;
d)   Article 24.2 (j) – “ensure lawful processing of personal data in accordance with Directive 95/46/EC”;
e)   Article 24.2 (k) – “in case of qualified trust service providers issuing qualified certificates, establish and keep updated a certificate database”;
f)   Article 24.3 – “If a qualified trust service provider issuing qualified certificates decides to revoke a certificate, it shall register such revocation in its certificate database and publish the revocation status of the certificate in a timely manner, and in any event within 24 hours after the receipt of the request. The revocation shall become effective immediately upon its publication”;
g)   Article 24.4 – "With regard to paragraph 3, qualified trust service providers issuing qualified certificates shall provide to any relying party information on the validity or revocation status of qualified certificates issued by them.

  • Technical specification
    56 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
prEN ISO/IEC 27006-2(Main)
Requirements for bodies providing audit and certification of information security management systems - Part 2: Privacy information management systems (ISO/IEC/DIS 27006‑2:2023)
oSIST prEN ISO/IEC 27006-2:2023

This document specifies requirements and provides guidance for bodies providing audit and certification of a privacy information management system (PIMS) according to ISO/IEC 27701 in combination with ISO/IEC 27001, in addition to the requirements contained within ISO/IEC 27006 and ISO/IEC 27701. It is primarily intended to support the accreditation of certification bodies providing PIMS certification.
The requirements contained in this document need to be demonstrated in terms of competence and reliability by anybody providing PIMS certification, and the guidance contained in this document provides additional interpretation of these requirements for any body providing PIMS certification.
NOTE This document can be used as a criteria document for accreditation, peer assessment or other audit processes.

  • Draft
    24 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
EN ISO/ASTM 52927:2024(Main)
Additive manufacturing - General principles - Main characteristics and corresponding test methods (ISO/ASTM 52927:2024)
kSIST FprEN ISO/ASTM 52927:2024

This document specifies the principal requirements applied to the testing of parts produced by additive manufacturing processes.
This document
—     identifies quality characteristics for feedstock and parts and the corresponding test procedures,
—     provides the specific procedures to build specimens using additive manufacturing process, and
—     recommends the scope and content of test and supply agreements.
This document is aimed at machine manufacturers, feedstock suppliers, AM system users, part providers, and customers to facilitate the communication on main quality characteristics. It applies wherever additive manufacturing processes are used.
NOTE            It is the intent to include, in future versions of this document, other characteristics such as thermal properties, electrical requirements and physical and physico-chemical properties based upon material types.

  • Draft
    28 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
EN ISO 22435:2024(Main)
Gas cylinders - Cylinder valves with integrated pressure regulators - Specification and type testing (ISO 22435:2024)
kSIST FprEN ISO 22435:2024

This document specifies design, type test methods, marking and instruction requirements for cylinder valves with integrated pressure regulators (VIPRs) intended to be fitted to gas cylinders, pressure drums or tubes or used as a main valve for bundles of cylinders that convey compressed, liquefied or dissolved gases.
These are requirements for VIPRs that are in addition to those given in the relevant closure standard, for example, in ISO 10297 for cylinder valves, in ISO 17871 for quick-release cylinder valves, in ISO 17879 for self-closing cylinder valves or in ISO 23826 for ball valves. For ISO 17871, these requirements are only applicable to quick-release cylinder valves types B, C, D and E.
NOTE 1        If the pressure regulating system of a VIPR is acting as the primary valve operating mechanism, it is covered by the relevant closure standard, e.g. ISO 10297, ISO 17871, ISO 17879 and ISO 23826. This also includes designs where closure of the primary valve operating mechanism of a VIPR is obtained by closing the seat of the pressure regulating system.
NOTE 2        If the primary valve operating mechanism of a VIPR is located at the low-pressure side of the pressure regulating system, it is covered by the relevant closure standard, e.g. ISO 10297, ISO 17871, ISO 17879 and ISO 23826.
NOTE 3        The term “pressure receptacle” is used within this document to cover instances where no differentiation is necessary between gas cylinders, bundles of cylinders, pressure drums and tubes.
This document does not apply to VIPRs for
a)       medical applications (see ISO 10524-3);
b)       liquefied petroleum gas (LPG);
c)        cryogenic applications.
NOTE 4        Additional requirements for a VIPR with a residual pressure device (RPD) are specified in ISO 15996.
NOTE 5        Additional requirements for pressure relief valves can exist in international/regional regulations/ standards.

  • Draft
    39 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
EN 683-2:2024(Main)
Aluminium and aluminium alloys - Finstock - Part 2: Mechanical properties
kSIST FprEN 683-2:2024

This document specifies the mechanical properties of wrought aluminium and wrought aluminium alloy finstock.
The chemical composition limits of these materials are specified in EN 573 3, unless otherwise agreed between supplier and purchaser.
The designations of wrought aluminium and wrought aluminium alloys and the temper designations used in this document are specified in EN 573 3, and the temper designations are defined in EN 515.

  • Draft
    12 pages
    English language
    sale 10% off
    e-Library read for
    1 day