ISO/IEC 27006:2015

Information technology — Security techniques — Requirements for bodies providing audit and certification of information security management systems

ISO/IEC 27006:2015 specifies requirements and provides guidance for bodies providing audit and certification of an information security management system (ISMS), in addition to the requirements contained within ISO/IEC 17021‑1 and ISO/IEC 27001. It is primarily intended to support the accreditation of certification bodies providing ISMS certification. The requirements contained in this International Standard need to be demonstrated in terms of competence and reliability by any body providing ISMS certification, and the guidance contained in this International Standard provides additional interpretation of these requirements for any body providing ISMS certification. NOTE This International Standard can be used as a criteria document for accreditation, peer assessment or other audit processes.

Technologies de l'information — Techniques de sécurité — Exigences pour les organismes procédant à l'audit et à la certification des systèmes de management de la sécurité de l'information

La présente Norme internationale spécifie les exigences et fournit des recommandations pour les organismes procédant à l'audit et à la certification d'un système de management de la sécurité de l'information (SMSI), en plus des exigences contenues dans l'ISO/IEC 17021‑1 et l'ISO/IEC 27001. Elle a pour principal objet de soutenir l'accréditation des organismes de certification qui procèdent à la certification de SMSI. Il est nécessaire que tout organisme qui procède à la certification de SMSI démontre qu'il respecte les exigences stipulées dans la présente Norme internationale en termes de compétences et de fiabilité, et les recommandations contenues dans la présente Norme internationale fournissent une interprétation supplémentaire de ces exigences pour tout organisme procédant à la certification de SMSI. NOTE La présente Norme internationale peut être utilisée comme référentiel pour l'accréditation, l'évaluation par des pairs ou d'autres processus d'audit.

Informacijska tehnologija - Varnostne tehnike - Zahteve za organe, ki izvajajo presojanje in certificiranje sistemov upravljanja informacijske varnosti

Ta mednarodni standard določa zahteve in podaja navodila za organe, ki izvajajo presojanje in certificiranje sistemov upravljanja informacijske varnosti (ISMS), ter se uporablja kot dodatek k zahtevam, določenim v standardih ISO/IEC 17021-1 in ISO/IEC 27001. Uporablja se predvsem kot podpora
za akreditacijo certifikacijskih organov, ki izvajajo certifikacijo ISMS.
Za izpolnjevanje zahtev, ki jih vsebuje ta mednarodni standard, mora vsak organ, ki izvaja certifikacijo ISMS, izkazati kompetentnost in zanesljivost, navodila v tem mednarodnem standardu pa podajajo dodatno interpretacijo teh zahtev za vsak organ, ki izvaja certifikacijo ISMS.
OPOMBA: Ta mednarodni standard se lahko uporablja kot dokument z merili za akreditacijo, medsebojno ocenjevanje ali druge procese presojanja.

General Information

• Status: Withdrawn
• Publication Date: 29-Sep-2015
• ICS: 03.100.70 - Management systems
• ICS: 03.120.20 - Product and company certification. Conformity assessment
• ICS: 35.030 - IT Security
• ICS: 35.040 - Information coding
• Technical Committee: ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
• Drafting Committee: ISO/IEC JTC 1/SC 27/WG 1 - Information security management systems
• Current Stage: 9599 - Withdrawal of International Standard
• Completion Date: 01-Mar-2024
• Ref Project: SIST ISO/IEC 27006:2018 - Information technology -- Security techniques -- Requirements for bodies providing audit and certification of information security management systems

Relations

• Amended By: ISO/IEC 27006:2015/Amd 1:2020 - Information technology — Security techniques — Requirements for bodies providing audit and certification of information security management systems — Amendment 1
• Effective Date: 24-Jul-2021
• Revised: ISO/IEC 27006-1:2024 - Information security, cybersecurity and privacy protection — Requirements for bodies providing audit and certification of information security management systems — Part 1: General
• Effective Date: 06-Jun-2022
• Revises: ISO/IEC 27006:2011 - Information technology — Security techniques — Requirements for bodies providing audit and certification of information security management systems
• Effective Date: 16-Jun-2012

Standards Content (Sample)

SLOVENSKI STANDARD
SIST ISO/IEC 27006:2018
01-november-2018
1DGRPHãþD
SIST ISO/IEC 27006:2012
Informacijska tehnologija - Varnostne tehnike - Zahteve za organe, ki izvajajo
presojanje in certificiranje sistemov upravljanja informacijske varnosti
Information technology -- Security techniques -- Requirements for bodies providing audit
and certification of information security management systems
Technologies de l'information -- Techniques de sécurité -- Exigences pour les
organismes procédant à l'audit et à la certification des systèmes de management de la
sécurité de l'information
Ta slovenski standard je istoveten z: ISO/IEC 27006:2015
ICS:
03.100.70 Sistemi vodenja Management systems
03.120.20 Certificiranje proizvodov in Product and company
podjetij. Ugotavljanje certification. Conformity
skladnosti assessment
35.030 Informacijska varnost IT Security
SIST ISO/IEC 27006:2018 en,fr,de
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

---------------------- Page: 1 ----------------------

SIST ISO/IEC 27006:2018

---------------------- Page: 2 ----------------------

SIST ISO/IEC 27006:2018
INTERNATIONAL ISO/IEC
STANDARD 27006
Third edition
2015-10-01
Information technology — Security
techniques — Requirements
for bodies providing audit and
certification of information security
management systems
Technologies de l’information — Techniques de sécurité — Exigences
pour les organismes procédant à l’audit et à la certification des
systèmes de management de la sécurité de l’information
Reference number
ISO/IEC 27006:2015(E)
©
ISO/IEC 2015

---------------------- Page: 3 ----------------------

SIST ISO/IEC 27006:2018
ISO/IEC 27006:2015(E)

COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2015, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. [phone]
Fax [phone]
[e-mail]
www.iso.org
ii © ISO/IEC 2015 – All rights reserved

---------------------- Page: 4 ----------------------

SIST ISO/IEC 27006:2018
ISO/IEC 27006:2015(E)

Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Principles . 1
5 General requirements . 2
5.1 Legal and contractual matters . 2
5.2 Management of impartiality . 2
5.2.1 IS 5.2 Conflicts of interest . 2
5.3 Liability and financing . 2
6 Structural requirements .
...

INTERNATIONAL ISO/IEC
STANDARD 27006
Third edition
2015-10-01
Information technology — Security
techniques — Requirements
for bodies providing audit and
certification of information security
management systems
Technologies de l’information — Techniques de sécurité — Exigences
pour les organismes procédant à l’audit et à la certification des
systèmes de management de la sécurité de l’information
Reference number
ISO/IEC 27006:2015(E)
©
ISO/IEC 2015

---------------------- Page: 1 ----------------------
ISO/IEC 27006:2015(E)

COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2015, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. [phone]
Fax [phone]
[e-mail]
www.iso.org
ii © ISO/IEC 2015 – All rights reserved

---------------------- Page: 2 ----------------------
ISO/IEC 27006:2015(E)

Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Principles . 1
5 General requirements . 2
5.1 Legal and contractual matters . 2
5.2 Management of impartiality . 2
5.2.1 IS 5.2 Conflicts of interest . 2
5.3 Liability and financing . 2
6 Structural requirements . 2
7 Resource requirements . 2
7.1 Competence of personnel . 2
7.1.1 IS 7.1.1 General considerations . 3
7.1.2 IS 7.1.2 Determination of Competence Criteria . 3
7.2 Personnel involved in the certification activities . 6
7.2.1 IS 7.2 Demonstration of auditor knowledge and experience . 6
7.3 Use of individual external auditors and external technical experts . 7
7.3.1 IS 7.3 Using external auditors or external technical experts as par
...

NORME ISO/IEC
INTERNATIONALE 27006
Troisième édition
2015-10
Technologies de l'information —
Techniques de sécurité — Exigences
pour les organismes procédant
à l'audit et à la certification des
systèmes de management de la
sécurité de l'information
Information technology — Security techniques — Requirements
for bodies providing audit and certification of information security
management systems
Numéro de référence
ISO/IEC 27006:2015(F)
©
ISO/IEC 2015

---------------------- Page: 1 ----------------------
ISO/IEC 27006:2015(F)

DOCUMENT PROTÉGÉ PAR COPYRIGHT
© ISO/IEC 2015
Tous droits réservés. Sauf prescription différente ou nécessité dans le contexte de sa mise en œuvre, aucune partie de cette
publication ne peut être reproduite ni utilisée sous quelque forme que ce soit et par aucun procédé, électronique ou mécanique,
y compris la photocopie, ou la diffusion sur l’internet ou sur un intranet, sans autorisation écrite préalable. Une autorisation peut
être demandée à l’ISO à l’adresse ci-après ou au comité membre de l’ISO dans le pays du demandeur.
ISO copyright office
Case postale 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Genève
Tél.: [phone]
E-mail: [e-mail]
Web: www.iso.org
Publié en Suisse
ii © ISO/IEC 2015 – Tous droits réservés

---------------------- Page: 2 ----------------------
ISO/IEC 27006:2015(F)

Sommaire Page
Avant-propos .v
Introduction .vi
1 Domaine d'application . 1
2 Références normatives . 1
3 Termes et définitions . 1
4 Principes . 1
5 Exigences générales . 2
5.1 Domaine juridique et contractuel . 2
5.2 Gestion de l’impartialité . 2
5.2.1 SI 5.2 Conflits d'intérêts . . 2
5.3 Responsabilité et situation financière . 2
6 Exigences structurelles . 2
7 Exigences relatives aux ressources . 2
7.1 Compétence du personnel . 2
7.1.1 SI 7.1.1 Considérations générales . 3
7.1.2 SI 7.1.2 Détermination des critères de compétence . 3
7.2 Personnel intervenant dans les activités de certification . 7
7.2.1 SI 7.2 Démonstration des connaissances et de l'expérience des auditeurs . 7
7.3 Intervention d’auditeurs et d’experts techniques externes individuels . 8
7.3.1 SI 7.3 Intervention d'auditeurs externes ou d'experts techniques externes
au sein de l'équipe
...

ةيلودلا ةيسايقلا ةفصاوملا
ةينقتورهكلا ةيلودلا ةنجللا /وزـــيأ
60772
ةيمسرلا ةمجرتلا
Official translation
Tradition officials

ثلاثلا رادصلإا
5102-01-10


قيقدتلا تاهج تابلطتم – نملأا تاينقت -- تامولعملا ايجولونكت
تامولعملا نمأ ةرادإ مظنل تاداهشلا رادصإو
Information technology — Security techniques — Requirements for bodies
providing audit and certification of information security management
systems (E)


Technologies de l’information — Techniques de sécurité — Exigences
pour les organismes procédant à l’audit et à la certification dessystèmes de
management de la sécurité de l’information(F)


يف ةمئاقلا رظنا( ةمجرتلا ةقد تدمتعأ يتلاISO يف ءاضعأ تائيه01نع ةبانلإاب ةيمسر ةيبرع ةمجرتك ارسيوس ،فينج يف ISO ةيزكرملا ةناملأا يف تعبط
.)ii ةحفص


ىعجرملا مقرلا
ISO\IEC 27006:2015 (A)
ةيمسرلا ةمجرتلا

©ISO 2015

---------------------- Page: 1 ----------------------
)ع( 5102/50112 يس يإ يأ/وزيأ


)هيونت( ةيلوئسم ءلاخإ
اذنه ةنعابط ننكمي هنإف Adobe ـل صيخرتلا ةسايس بجومبو ،ةجمدُم طوطخ ىلع )PDF( فلملا اذه يوتحي دق
متي يذلا بوساحلا يف ةلَّمحُمو ةصخرُمهيف ةجمدُملا طوطخلا نكت مل ام هليدعت متي َّلاأ ىلع ،هيلععلاطلاا وأ فلملا
ينف ،Adobe ـل صيخرتلا ةسايسب للاخلإا مدع ةيلوئسم - فلملا اذه ليزنت دنع - فارطلأا لمحتت و.ليدعتلا هيف
.لاجملا اذه لايح ةينوناق ةيلوئسم يأ لمحتت لاوزيلألةماعلا ةيراتركسلا نأنيح
Adobe.ـلا مظنل ةدحتملا ةكرشلل ةلجسم ةيراجت ةملاع Adobe ـلا دعت
ةنماعلا تانمولعملا ننم فنلملا اذنه ءانشنإ ينف ةمدختنسملا مماربلانب ةنصاخلا لينصافتلا نيمج ينلع لوصحلا نكمي
نونكي نأ ينعوُر ثنيح ،)PDF( ءانشنإ يف ةلخادلا تاريغتملا تن سُح دقف ةعابطلا لجلأو ، )PDF(فلمب ةقلعتملا
، فنلملا اذنهب لنلعتت ةلكنشم يأ شودنح ةنلاح ينفو ، ينيقتلل ةنيلودلا ةنمظنملا ءاضعلأ امئلام فلملا اذه مادختسا
.هاندأ لجسملا ناونعلا ىلع ةماعلا ةيراتركسلا غلابإ ىجرُي

ةفصاوملا تدمتعا يتلا ةيبرعلا سييقتلا تاهج
ندرلأا
ةيندرلأا سيياقملاو تافصاوملا ةسسؤم 
 تاراملإا
سيياقملاو تافصاوملل تاراملإا ةئيه  
رئازجلا
سييقتلل يرئازجلا دهعملا  
ةيدوعسلا
سيياقملاو تافصاوملل ةيدوعسلا ةئيهلا  
قارعلا
 ةيعونلا ةرطيسلاو سييقتلل يزكرملا زاهجلا 
تيوكلا
ةعانصلل ةماعلا ةئيهلا 
نادوسلا
سيياقملاو تافصاوملل ةينادوسلا ةئيهلا 
نميلا
ةدوجلا طبضو سيياقملاو تافصاوملل ةينميلا ةئيهلا 
سنوت
 ةيعانصلا ةيكلملاو تافصاوملل ينطولا دهعملا 
ايروس
ةيروسلا ةيبرعلا سيياقملاو تافصاوملا ةئيه 
ايبيل
ةيسايقلا ريياعملاو تافصاوملل ينطولا زكرملا 
رصم
ةدوجلاو تافصاوملل ةماعلا ةيرصملا ةئيهلا 

رشنلاو عبطلا قوقح ةيامح ةقيثو
©5102وزيأ
ةليسو يأب وأ لكش يأب همادختسا وأ رادصلإا اذه نم ءزج يأ جاتنإ ةداعإ زوجي لا ،كلذ فلاخ دري كل امو .ةظوفحم قوقحلا يمج
دحا وأ هاندأ ناونعلا ىلع ييقتلل ةيلودلا ةمظنملا نم امإ يطخ نذإ نود ةقيقدلا ملافلأاو خسنلا كلذ يف امب ةيكيناكيم وأ ةينورتكلا
.ةبلاطلا ةهجلا ةلود يف ييقتلل ةيلودلا ةمظنملا يف ءاضعلأا تائيهلا
 ييقتلل ةيلودلا ةمظنملا ةيكلم قوقح بتكم
 51 فينج -Ch-1211- 22 :يديربلا زمرلا
1120550221000 :فتاه
 1120550221220 : كاف
 [e-mail] :ينورتكلا ديرب
www.iso.org :ينورتكللاا قوملا
5100يف ةيبرعلاةخسنلا رشن مت
 ارسيوس يف رشنلا مت

© ISO 2015 - ةظوفحم قوقحلا عيمج                                                    ii

---------------------- Page: 2 ----------------------
)ع( 5102/50112يس يإ يأ / وزيأ


تايوتحملا
v  .ديهمت
iv . . ةمدقم
1   .   لاجملا -1
1 .  ةيليمكتلا عجارملا -6
1 .  فيراعتلاو تاحلطصملا -3
  1    . ئدابملا -4
     . 6 ةماعلا تابلطتملا -5
     . 5  ةيدقاعتلاو ةينوناقلا نوئشلا 0/2
     . 5 . ةيدايحلا ةرادإ 5/2
 5    . )حلاصملا( تامامتهلاا ضراعت5/2 مأ 0/5/2
     . 5 ليومتلاو تامازتللاا 3/2
     . 6 ةيلكيهلا تابلطتملا -2
      .
...