EN ISO/IEC 27006:2020

Information technology - Security techniques - Requirements for bodies providing audit and certification of information security management systems (ISO/IEC 27006:2015, including Amd 1:2020)

ISO/IEC 27006:2015 specifies requirements and provides guidance for bodies providing audit and certification of an information security management system (ISMS), in addition to the requirements contained within ISO/IEC 17021‑1 and ISO/IEC 27001. It is primarily intended to support the accreditation of certification bodies providing ISMS certification.
The requirements contained in this International Standard need to be demonstrated in terms of competence and reliability by any body providing ISMS certification, and the guidance contained in this International Standard provides additional interpretation of these requirements for any body providing ISMS certification.
NOTE          This International Standard can be used as a criteria document for accreditation, peer assessment or other audit processes.

Informationstechnik - IT-Sicherheitsverfahren - Anforderungen an Institutionen, die Audits und Zertifizierungen von Informationssicherheits-Managementsystemen anbieten (ISO/IEC 27006:2015, einschließlich Amd.1:2020)

Diese Internationale Norm legt Anforderungen fest und bietet Anleitung für Stellen, die Audits und Zertifizierungen von Informationssicherheitsmanagementsystemen (ISMS), vornehmen. Zusätzlich gelten die Anforderungen nach ISO/IEC 17021-1 und ISO/IEC 27001. Sie dient hauptsächlich der Unterstützung der Akkreditierung von Zertifizierungsstellen, die ISMS-Zertifizierungen durchführen.
Die Anforderungen in dieser Norm bedürfen im Hinblick auf Kompetenz und Zuverlässigkeit von jeder Stelle, die ISMS-Zertifizierungen durchführt, eines Nachweises, und die Anleitungen in dieser Internationalen Norm erlauben die weitere Interpretation dieser Anforderungen für jede Stelle, die ISMS-Zertifizierungen durchführt.
ANMERKUNG Diese Internationale Norm kann als Kriteriendokument für die Akkreditierung, die Bewertung unter Gleichrangigen oder für andere Auditprozesse verwendet werden.

Technologies de l'information - Techniques de sécurité - Exigences pour les organismes procédant à l'audit et à la certification des systèmes de management de la sécurité de l'information (ISO/IEC 27006:2015, y compris Amd 1:2020)

La présente Norme internationale spécifie les exigences et fournit des recommandations pour les organismes procédant à l'audit et à la certification d'un système de management de la sécurité de l'information (SMSI), en plus des exigences contenues dans l'ISO/IEC 17021‑1 et l'ISO/IEC 27001. Elle a pour principal objet de soutenir l'accréditation des organismes de certification qui procèdent à la certification de SMSI.
Il est nécessaire que tout organisme qui procède à la certification de SMSI démontre qu'il respecte les exigences stipulées dans la présente Norme internationale en termes de compétences et de fiabilité, et les recommandations contenues dans la présente Norme internationale fournissent une interprétation supplémentaire de ces exigences pour tout organisme procédant à la certification de SMSI.
NOTE       La présente Norme internationale peut être utilisée comme référentiel pour l'accréditation, l'évaluation par des pairs ou d'autres processus d'audit.

Informacijska tehnologija - Varnostne tehnike - Zahteve za organe, ki izvajajo presojanje in certificiranje sistemov upravljanja informacijske varnosti (ISO/IEC 27006:2015, vključno z dopolnilom 1:2020)

General Information

• Status: Withdrawn
• Publication Date: 24-Nov-2020
• Withdrawal Date: 13-Apr-2025
• ICS: 03.120.20 - Product and company certification. Conformity assessment
• ICS: 35.030 - IT Security
• Technical Committee: CEN/CLC/TC 13 - Cybersecurity and Data Protection
• Drafting Committee: CEN/CLC/TC 13 - Cybersecurity and Data Protection
• Current Stage: 9960 - Withdrawal effective - Withdrawal
• Start Date: 13-Mar-2024
• Completion Date: 14-Apr-2025
• Ref Project: SIST EN ISO/IEC 27006:2021 - Information technology - Security techniques - Requirements for bodies providing audit and certification of information security management systems (ISO/IEC 27006:2015, including Amd 1:2020)

Relations

• Replaced By: EN ISO/IEC 27006-1:2024 - Information security, cybersecurity and privacy protection - Requirements for bodies providing audit and certification of information security management systems - Part 1: General (ISO/IEC 27006-1:2024)
• Effective Date: 18-Mar-2024

Standards Content (Sample)

SLOVENSKI STANDARD
01-februar-2021
Informacijska tehnologija - Varnostne tehnike - Zahteve za organe, ki izvajajo
presojanje in certificiranje sistemov upravljanja informacijske varnosti (ISO/IEC
27006:2015, vključno z dopolnilom 1:2020)
Information technology - Security techniques - Requirements for bodies providing audit
and certification of information security management systems (ISO/IEC 27006:2015,
including Amd 1:2020)
Informationstechnik - IT-Sicherheitsverfahren - Anforderungen an Institutionen, die Audits
und Zertifizierungen von Informationssicherheits-Managmentsystemen anbieten
(ISO/IEC 27006:2015, einschließlich Amd 1:2020)
Technologies de l'information - Techniques de sécurité - Exigences pour les organismes
procédant à l'audit et à la certification des systèmes de management de la sécurité de
l'information (ISO/IEC 27006:2015, y compris Amd 1:2020)
Ta slovenski standard je istoveten z: EN ISO/IEC 27006:2020
ICS:
03.100.70 Sistemi vodenja Management systems
03.120.20 Certificiranje proizvodov in Product and company
podjetij. Ugotavljanje certification. Conformity
skladnosti assessment
35.030 Informacijska varnost IT Security
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

EUROPEAN STANDARD
EN ISO/IEC 27006
NORME EUROPÉENNE
EUROPÄISCHE NORM
November 2020
ICS 03.120.20; 35.030
English version
Information technology - Security techniques -
Requirements for bodies providing audit and certification
of information security management systems (ISO/IEC
27006:2015, including Amd 1:2020)
Technologies de l'information - Techniques de sécurité Informationstechnik - IT-Sicherheitsverfahren -
- Exigences pour les organismes procédant à l'audit et Anforderungen an Institutionen, die Audits und
à la certification des systèmes de management de la Zertifizierungen von Informationssicherheits-
sécurité de l'information (ISO/IEC 27006:2015, y Managmentsystemen anbieten (ISO/IEC 27006:2015,
compris Amd 1:2020) einschließlich Amd 1:2020)
This European Standard was approved by CEN on 16 November 2020.

CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for
giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical
references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to
any CEN and CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.

CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium,
Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia,
Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and United Kingdom.

CEN-CENELEC Management Centre:
Rue de la Science 23, B-1040 Brussels
© 2020 CEN/CENELEC All rights of exploitation in any form and by any means Ref. No. EN ISO/IEC 27006:2020 E
reserved worldwide for CEN national Members and for
CENELEC Members.
Contents Page
European foreword . 3

European foreword
The text of ISO/IEC 27006:2015 has been prepared by Technical Committee ISO/IEC JTC 1 "Information
technology” of the International Organization for Standardization (ISO) and has been taken over as
the secretariat of which is held by DIN.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by May 2021, and conflicting national standards shall be
withdrawn at the latest by May 2021.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN shall not be held responsible for identifying any or all such patent rights.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland,
Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of
North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and the
United Kingdom.
Endorsement notice
The text of ISO/IEC 27006:2015 has been approved by CEN as EN ISO/IEC 27006:2020 without any
modification.
INTERNATIONAL ISO/IEC
STANDARD 27006
Third edition
2015-10-01
Information technology — Security
techniques — Requirements
for bodies providing audit and
certification of information security
management systems
Technologies de l’information — Techniques de sécurité — Exigences
pour les organismes procédant à l’audit et à la certification des
systèmes de management de la sécurité de l’information
Reference number
ISO/IEC 27006:2015(E)
©
ISO/IEC 2015
ISO/IEC 27006:2015(E)
© ISO/IEC 2015, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. [phone]
Fax [phone]
[e-mail]
www.iso.org
ii © ISO/IEC 2015 – All rights reserved

ISO/IEC 27006:2015(E)
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Principles . 1
5 General requirements . 2
5.1 Legal and contractual matters . 2
5.2 Management of impartiality . 2
5.2.1 IS 5.2 Conflicts of interest . 2
5.3 Liability and financing . 2
6 Structural requirements . 2
7 Resource requirements . 2
7.1 Competence of personnel . 2
7.1.1 IS 7.1.1 General considerations . 3
7.1.2 IS 7.1.2 Determination of Competence Criteria . 3
7.2 Personnel involved in the certification activities . 6
7.2.1 IS 7.2 Demonstration of auditor knowledge and experience . 6
7.3 Use of individual external auditors and external technical experts . 7
7.3.1 IS 7.3 Using external auditors or external technical experts as part of the
audit team . 7
7.4 Personnel records. 7
7.5 Outsourcing. 7
8 Information requirements . 8
8.1 Public information . 8
8.2 Certification documents . 8
8.2.1 IS 8.2 ISMS Certification documents . 8
8.3 Reference to certification and use of marks . 8
8.4 Confidentiality . 8
8.4.1 IS 8.4 Access to organizational records . 8
8.5 Information exchange between a certification body and its clients . 8
9 Process requirements . 8
9.1 Pre-certification activities . 8
9.1.1 Application . 8
9.1.2 Application review . 9
9.1.3 Audit programme . 9
9.1.4 Determining audit time .10
9.1.5 Multi-site sampling .10
9.1.6 Multiple management systems .11
9.2 Planning audits .11
9.2.1 Determining audit objectives, scope and criteria .11
9.2.2 Audit team selection and assignments .12
9.2.3 Audit plan .12
9.3 Initial certification .13
9.3.1 IS 9.3.1 Initial certification audit .13
9.4 Conducting audits .14
9.4.1 IS 9.4 General .14
9.4.2 IS 9.4 Specific elements of the ISMS audit .14
9.4.3 IS 9.4 Audit report .14
9.5 Certification decision .15
9.5.1 IS 9.5 Certification decision .15
© ISO/IEC 2015 – All rights reserved iii

ISO/IEC 27006:2015(E)
9.6 Maintaining certification .15
9.6.1 General.15
9.6.2 Surveillance activities .15
9.6.3 Re-certification .16
9.6.4 Special audits .17
9.6.5 Suspending, withdrawing or reducing the scope of certification .17
9.7 Appeals .17
9.8 Complaints .17
9.8.1 IS 9.8 Complaints .17
9.9 Client records .17
10 Management system requirements for certification bodies .17
10.1 Options .17
10.1.1 IS 10.1 ISMS implementation .17
10.2 Option A: General management system requirements .17
10.3 Option B: Management system requirements in accordance with ISO 9001.17
Annex A (informative) Knowledge and skills for ISMS auditing and certification .18
Annex B (normative) Audit time .20
Annex C (informative) Methods for audit time calculations .25
Annex D (informative) Guidance for review of implemented ISO/IEC 27001:2013,
Annex A controls .28
Bibliography .35
iv © ISO/IEC 2015 – All rights reserved

ISO/IEC 27006:2015(E)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for
the different types of document should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent
rights. Details of any patent rights identified during the development of the document will be in the
Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the meaning of ISO specific terms and expressions related to conformity
assessment, as well as information about ISO’s adherence to the WTO principles in the Technical
Barriers to Trade (TBT) see the following URL: Foreword - Supplementary information
The committee responsible for this document is ISO/IEC JTC 1, Information technology, SC 27, IT
Security techniques.
ISO/IEC 27006 was prepared by the Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, IT Security techniques.
This third edition cancels and replaces the second edition (ISO/IEC 27006:2011), which has been
technically revised.
© ISO/IEC 2015 – All rights reserved v

ISO/IEC 27006:2015(E)
Introduction
ISO/IEC 17021-1 sets out criteria for bodies operating audit and certification of management systems. If
such bodies are to be accredited as complying with ISO/IEC 17021-1 with the objective of auditing and
certifying information security management systems (ISMS) in accordance with ISO/IEC 27001:2013,
some additional requirements and guidance to ISO/IEC 17021-1 are necessary. These are provided by
this International Standard.
The text in this International Standard follows the structure of ISO/IEC 17021-1 and the additional
ISMS-specific requirements and guidance on the application of ISO/IEC 17021-1 for ISMS certification
are identified by the letters “IS”.
The term “shall” is used throughout this International Standard to indicate those provisions which,
reflecting the requirements of ISO/IEC 17021-1 and ISO/IEC 27001, are mandatory. The term “should” is
used to indicate recommendation.
The primary purpose of this International Standard is to enable accreditation bodies to more effectively
harmonize their application of the standards against which they are bound to assess certification bodies.
Throughout this International Standard, the terms “management system” and “system” are used
interchangeably. The definition of a management system can be found in ISO 9000:2005. The
management system as used in this International Standard is not to be confused with other types of
systems, such as IT systems.
vi © ISO/IEC 2015 – All rights reserved

INTERNATIONAL STANDARD ISO/IEC 27006:2015(E)
Information technology — Security techniques —
Requirements for bodies providing audit and certification
of information security management systems
1 Scope
This International Standard specifies requirements and provides guidance for bodies providing
audit and certification of an information security management system (ISMS), in addition to the
requirements contained within ISO/IEC 17021-1 and ISO/IEC 27001. It is primarily intended to support
the accreditation of certification bodies providing ISMS certification.
The requirements contained in this International Standard need to be demonstrated in terms of
competence and reliability by any body providing ISMS certification, and the guidance contained in
this International Standard provides additional interpretation of these requirements for any body
providing ISMS certification.
NOTE This International Standard can be used as a criteria document for accreditation, peer assessment or
other audit processes.
2 Normative references
The following documents, in whole or in part, are normatively referenced in this document and are
indispensable for its application. For dated references, only the edition cited applies. For undated
references, the latest edition of the referenced document (including any amendments) applies.
ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies providing audit and certification
of management systems — Part 1: Requirements
ISO/IEC 27000, Information technology — Security techniques — Information security management
systems — Overview and vocabulary
ISO/IEC 27001:2013, Information technology — Security techniques — Information security management
systems — Requirements
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/IEC 17021-1, ISO/IEC 27000
and the following apply.
3.1
certification documents
documents indicating that a client’s ISMS conforms to specified ISMS standards and any supplementary
documentation required under the system
4 Principles
The principles from ISO/IEC 17021-1, 4 apply.
© ISO/IEC 2015 – All rights reserved 1

ISO/IEC 27006:2015(E)
5 General requirements
5.1 Legal and contractual matters
The requirements of ISO/IEC 17021-1, 5.1 apply.
5.2 Management of impartiality
The requirements of ISO/IEC 17021-1, 5.2 apply. In addition, the following requirements and
guidance apply.
5.2.1 IS 5.2 Conflicts of interest
Certification bodies may carry out the following duties without them being considered as consultancy
or having a potential conflict of interest:
a) arranging and participating as a lecturer in training courses, provided that, where these
courses relate to information security management, related management systems or auditing,
certification bodies shall confine themselves to the provision of generic information and advice
which is publicly available, i.e. they shall not provide company-specific advice which contravenes
the requirements of b) below;
b) making available or publishing on request information describing the certification body’s
interpretation of the requirements of the certification audit standards (see 9.1.3.6);
c) activities prior to audit, solely aimed at determining readiness for certification audit; however, such
activities shall not result in the provision of recommendations or advice that would contravene this
clause and the certification body shall be able to confirm that such activities do not contravene
these requirements and that they are not used to justify a reduction in the eventual certification
audit duration;
d) performing second and third-party audits according to standards or regulations other than those
being part of the scope of accreditation;
e) adding value during certification audits and surveillance visits, e.g. by identifying opportunities for
improvement, as they become evident during the audit, without recommending specific solutions.
The certification body shall not provide internal information security reviews of the client’s ISMS
subject to certification. Furthermore, the certification body shall be independent from the body or
bodies (including any individuals) which provide the internal ISMS audit.
5.3 Liability and financing
The requirements of ISO/IEC 17021-1, 5.3 apply.
6 Structural requirements
The requirements of ISO/IEC 17021-1, 6 apply.
7 Resource requirements
7.1 Competence of personnel
The requirements of ISO/IEC 17021-1, 7.1 apply. In addition, the following requirements and
guidance apply.
2 © ISO/IEC 2015 – All rights reserved

ISO/IEC 27006:2015(E)
7.1.1 IS 7.1.1 General considerations
7.1.1.1 Generic competence requirements
The certification body shall ensure that it has knowledge of the technological, legal and regulatory
developments relevant to the ISMS of the client which it assesses.
The certification body shall define the competence requirements for each certification function as
referenced in Table A.1 of ISO/IEC 17021-1. The certification body shall take into account all the
requirements specified in ISO/IEC 17021-1 and 7.1.2 and 7.2.1 of this International Standard that are
relevant for the ISMS technical areas as determined by the certification body.
NOTE Annex A provides a summary of the competence requirements for personnel involved in specific
certification functions.
7.1.2 IS 7.1.2 Determination of Competence Criteria
7.1.2.1 Competence requirements for ISMS auditing
7.1.2.1.1 General requirements
The certification body shall have criteria for verifying the background experience, specific training or
briefing of audit team members that ensures at least:
a) knowledge of information security;
b) technical knowledge of the activity to be audited;
c) knowledge of management systems;
d) knowledge of the principles of auditing;
NOTE Further information on the principles of auditing can be found in ISO 19011.
e) knowledge of ISMS monitoring, measurement, analysis and evaluation.
These above requirements a) to e) apply to all auditors being part of the audit team, with the exception
of b), which can be shared among auditors being part of the audit team.
The audit team shall be competent to trace indications of information security incidents in the client’s
ISMS back to the appropriate elements of the ISMS.
The audit team shall have appropriate work experience of the items above and practical application
of these items (this does not mean that an auditor needs a complete range of experience of all areas of
information security, but the audit team as a whole shall have enough appreciation and experience to
cover the ISMS scope being audited).
7.1.2.1.2 Information security management terminology, principles, practices and techniques
Collectively, all members of the audit team shall have knowledge of:
a) ISMS specific documentation structures, hierarchy and interrelationships;
b) information security management related tools, methods, techniques and their application;
c) information security risk assessment and risk management;
d) processes applicable to ISMS;
e) the current technology where information security may be relevant or an issue.
© ISO/IEC 2015 – All rights reserved 3

ISO/IEC 27006:2015(E)
Every auditor shall fulfil a), c) and d).
7.1.2.1.3 Information security management system standards and normative documents
Auditors involved in ISMS auditing shall have knowledge of:
a) all requirements contained in ISO/IEC 27001.
Collectively, all members of the audit team shall have knowledge of:
b) all controls contained in ISO/IEC 27002 (if determined as necessary also from sector specific
standards) and their implementation, categorized as:
1) information security policies;
2) organization of information security;
3) human resource security;
4) asset management;
5) access control, including authorization;
6) cryptography;
7) physical and environmental security;
8) operations security, including IT-services;
9) communications security, including network security management and information transfer;
10) system acquisition, development and maintenance;
11) supplier relationships, including outsourced services;
12) information security incident management;
13) information security aspects of business continuity management, including redundancies;
14) compliance, including information security reviews.
7.1.2.1.4 Business management practices
Auditors involved in ISMS auditing shall have knowledge of:
a) industry information security good practices and information security procedures;
b) policies and business requirements for information security;
c) general business management concepts, practices and the inter-relationship between policy,
objectives and results;
d) management processes and related terminology.
NOTE These processes also include human resources management, internal and external communication
and other relevant support processes.
7.1.2.1.5 Client business sector
Auditors involved in ISMS auditing shall have knowledge of:
a) the legal and regulatory requirements in the particular information security field, geography and
jurisdiction(s);
4 © ISO/IEC 2015 – All rights reserved

ISO/IEC 27006:2015(E)
NOTE Knowledge of legal and regulatory requirements does not imply a profound legal background.
b) information security risks related to business sector;
c) generic terminology, processes and technologies related to the client business sector;
d) the relevant business sector practices.
The criteria a) may be shared amongst the audit team.
7.1.2.1.6 Client products, processes and organization
Collectively, auditors involved in ISMS auditing shall have knowledge of:
a) the impact of organization type, size, governance, structure, functions and relationships on
development and implementation of the ISMS and certification activities, including outsourcing;
b) complex operations in a broad perspective;
c) legal and regulatory requirements applicable to the product or service.
7.1.2.2 Competence requirements for leading the ISMS audit team
In addition to the requirements in 7.1.2.1, audit team leaders shall fulfil the following requirements,
which shall be demonstrated in audits under guidance and supervision:
a) knowledge and skills to manage the certification audit process and the audit team;
b) demonstration of the capability to communicate effectively, both orally and in writing.
7.1.2.3 Competence requirements for conducting the application review
7.1.2.3.1 Information security management system standards and normative documents
Personnel conducting the application review to determine audit team competence required, to select
the audit team members and to determine the audit time shall have knowledge of:
a) relevant ISMS standards and other normative documents used in the certification process.
7.1.2.3.2 Client business sector
Personnel conducting the application review to determine the audit team competence required, to
select the audit team members and to determine the audit time shall have knowledge of:
a) generic terminology, processes, technologies and risks related to the client business sector.
7.1.2.3.3 Client products, processes and organization
Personnel conducting the application review to determine audit team competence required, to select
the audit team members and to determine the audit time shall have knowledge of:
a) client products, processes, organization types, size, governance, structure, functions and
relationships on development and implementation of the ISMS and certification activities, including
outsourcing functions.
© ISO/IEC 2015 – All rights reserved 5

ISO/IEC 27006:2015(E)
7.1.2.4 Competence requirements for reviewing audit reports and making certification decisions
7.1.2.4.1 General
The personnel reviewing audit reports and making certification decisions shall have knowledge that
enables them to verify the appropriateness of the scope of certification as well as changes to the
scope and their impact on the effectiveness of the audit, in particular the continuing validity of the
identification of interfaces and dependencies and the associated risks.
Additionally, the personnel reviewing audit reports and making the certification decisions shall have
knowledge of:
a) management systems in general;
b) audit processes and procedures;
c) audit principles, practices and techniques.
7.1.2.4.2 Information security management terminology, principles, practices and techniques
The personnel reviewing audit reports and making the certification decisions shall have knowledge of:
a) the items listed in 7.1.2.1.2 a), c) and d);
b) legal and regulatory requirements relevant to information security.
7.1.2.4.3 Information security management system standards and normative documents
Personnel reviewing audit reports and making certification decisions shall have knowledge of:
a) relevant ISMS standards and other normative documents used in the certification process.
7.1.2.4.4 Client business sector
Personnel reviewing audit reports and making certification decisions shall have knowledge of:
a) generic terminology and risks related to the relevant business sector practices.
7.1.2.4.5 Client products, processes and organization
Personnel reviewing audit reports and making certification decisions shall have knowledge of:
a) client products, processes, organization types, size, governance, structure, functions and
relationships.
7.2 Personnel involved in the certification activities
The requirements of ISO/IEC 17021-1, 7.2 apply. In addition, the following requirements and
guidance apply.
7.2.1 IS 7.2 Demonstration of auditor knowledge and experience
The certification body shall demonstrate that the auditors have knowledge and experience through:
a) recognized ISMS-specific qualifications;
b) registration as auditor where applicable;
c) participation in ISMS training courses and attainment of relevant personal credentials;
d) up to date professional development records;
6 © ISO/IEC 2015 – All rights reserved

ISO/IEC 27006:2015(E)
e) ISMS audits witnessed by another ISMS auditor.
7.2.1.1 Selecting auditors
In addition to 7.1.2.1, the criteria for selecting auditors shall ensure that each auditor:
a) has professional education or training to an equivalent level of university education;
b) has at least four years full time practical workplace experience in information technology, of which
at least two years are in a role or function relating to information security;
c) has successfully completed at least five days of training, the scope of which covers ISMS audits and
audit management;
d) has gained experience in the entire process of assessing information security prior to assuming
responsibility for performing as an auditor. This experience should have been gained by
participation in a minimum of four ISMS certification audits, including re-certification and
surveillance audits, for a total of at least 20 days of which at most 5 days may come from
surveillance audits. The participation shall include review of documentation and risk assessment,
implementation assessment and audit reporting;
e) has relevant and current experience;
f) keeps current knowledge and skills in information security and auditing up to date through
continual professional development.
Technical experts shall comply with criteria a), b) and e).
7.2.1.2 Selecting auditors for leading the team
In addition to 7.1.2.2 and 7.2.1.1, the criteria for selecting an auditor for leading the team shall ensure
that this auditor:
a) has actively participated in all stages of at least three ISMS audits. The participation shall include
initial scoping and planning, review of documentation and risk assessment, implementation
assessment and formal audit reporting.
7.3 Use of individual external auditors and external technical experts
The requirements of ISO/IEC 17021-1, 7.3 apply. In addition, the following requirements and
guidance apply.
7.3.1 IS 7.3 Using external auditors or external technical experts as part of the audit team
Technical experts shall work under the supervision of an auditor. The minimum requirements for
technical experts are listed in 7.2.1.1.
7.4 Personnel records
The requirements of ISO/IEC 17021-1, 7.4 apply.
7.5 Outsourcing
The requirements of ISO/IEC 17021-1, 7.5 apply.
© ISO/IEC 2015 – All rights reserved 7

ISO/IEC 27006:2015(E)
8 Information requirements
8.1 Public information
The requirements of ISO/IEC 17021-1, 8.1 apply.
8.2 Certification documents
The requirements of ISO/IEC 17021-1, 8.2 apply. In addition, the following requirements and
guidance apply.
8.2.1 IS 8.2 ISMS Certification documents
Certification documents shall be signed by an officer who has been assigned such responsibility. The
version of the Statement of Applicability shall be included in the certification documents.
NOTE A change to the Statement of Applicability which does not change the coverage of the controls in the
scope of certification does not require an update of the certification document.
Identification of the sector-specific standard(s) used may also be included in the certification documents.
8.3 Reference to certification and use of marks
The requirements of ISO/IEC 17021-1, 8.3 apply.
8.4 Confidentiality
The requirements of ISO/IEC 17021-1, 8.4 apply. In addition, the following requirements and
guidance apply.
8.4.1 IS 8.4 Access to organizational records
Before the certification audit, the certification body shall ask the client to report if any ISMS related
information (such as ISMS records or information about design and effectiveness of controls) cannot be
made available for review by the audit team because it contains confidential or sensitive information.
The certification body shall determine whether the ISMS can be adequately audited in the absence of
such information. If the certification body concludes that it is not possible to adequately audit the ISMS
without reviewing the identified confidential or sensitive information, it shall advise the client that the
certification audit cannot take place until appropriate access arrangements are granted.
8.5 Information exchange between a certification body and its clients
The requirements of ISO/IEC 17021-1, 8.5 apply.
9 Process requirements
9.1 Pre-certification activities
9.1.1 Application
The requirements of ISO/IEC 17021-1, 9.1.1 apply. In addition, the following requirements and
guidance apply.
8 © ISO/IEC 2015 – All rights reserved

ISO/IEC 27006:2015(E)
9.1.1.1 IS 9.1.1 Application readiness
The certification body shall require the client to have a documented and implemented ISMS which
conforms to ISO/IEC 27001 and other documents required for certification.
9.1.2 Application review
The requirements of ISO/IEC 17021-1, 9.1.2 apply.
9.1.3 Audit programme
The requirements of ISO/IEC 17021-1, 9.1.3 apply. In addition, the following requirements and
guidance apply.
9.1.3.1 IS 9.1.3 General
The audit programme for ISMS audits shall take the determined information security controls into
account.
9.1.3.2 IS 9.1.3 Audit Methodology
The certification body’s procedures shall not presuppose a particular manner of implementation of
an ISMS or a particular format for documentation and records. Certification procedures shall focus on
establishing that a client’s ISMS meets the requirements specified in ISO/IEC 27001 and the policies
and objectives of the client.
NOTE Further guidance on auditing is given in ISO/IEC 27007.
9.1.3.3 IS 9.1.3 General preparations for the initial audit
The certification body shall require that a client makes all necessary arrangements for the access to
internal audit reports and reports of independent reviews of information security.
At least the following information shall be provided by the client during stage 1 of the certific
...