Information technology - Security techniques - Requirements for bodies providing audit and certification of information security management systems (ISO/IEC 27006:2015, including Amd 1:2020)

This International Standard specifies requirements and provides guidance for bodies providing
audit and certification of an information security management system (ISMS), in addition to the
requirements contained within ISO/IEC 17021-1 and ISO/IEC 27001. It is primarily intended to support
the accreditation of certification bodies providing ISMS certification.
The requirements contained in this International Standard need to be demonstrated in terms of
competence and reliability by any body providing ISMS certification, and the guidance contained in
this International Standard provides additional interpretation of these requirements for any body
providing ISMS certification.
NOTE This International Standard can be used as a criteria document for accreditation, peer assessment or
other audit processes.

Informationstechnik - IT-Sicherheitsverfahren - Anforderungen an Institutionen, die Audits und Zertifizierungen von Informationssicherheits-Managmentsystemen anbieten (ISO/IEC 27006:2015, einschließlich Amd 1:2020)

Diese Internationale Norm legt Anforderungen fest und bietet Anleitung für Stellen, die Audits und Zertifizierungen von Informationssicherheitsmanagementsystemen (ISMS), vornehmen. Zusätzlich gelten die Anforderungen nach ISO/IEC 17021-1 und ISO/IEC 27001. Sie dient hauptsächlich der Unterstützung der Akkreditierung von Zertifizierungsstellen, die ISMS-Zertifizierungen durchführen.
Die Anforderungen in dieser Norm bedürfen im Hinblick auf Kompetenz und Zuverlässigkeit von jeder Stelle, die ISMS-Zertifizierungen durchführt, eines Nachweises, und die Anleitungen in dieser Internationalen Norm erlauben die weitere Interpretation dieser Anforderungen für jede Stelle, die ISMS-Zertifizierungen durchführt.
ANMERKUNG Diese Internationale Norm kann als Kriteriendokument für die Akkreditierung, die Bewertung unter Gleichrangigen oder für andere Auditprozesse verwendet werden.

Technologies de l'information - Techniques de sécurité - Exigences pour les organismes procédant à l'audit et à la certification des systèmes de management de la sécurité de l'information (ISO/IEC 27006:2015, y compris Amd 1:2020)

Informacijska tehnologija - Varnostne tehnike - Zahteve za organe, ki izvajajo presojanje in certificiranje sistemov upravljanja informacijske varnosti (ISO/IEC 27006:2015, vključno z dopolnilom 1:2020)

General Information

Status
Published
Public Enquiry End Date
11-Oct-2020
Publication Date
17-Jan-2021
Technical Committee
Current Stage
6060 - National Implementation/Publication (Adopted Project)
Start Date
05-Jan-2021
Due Date
12-Mar-2021
Completion Date
18-Jan-2021

Buy Standard

Standard
SIST EN ISO/IEC 27006:2021
English language
49 pages
sale 10% off
Preview
sale 10% off
Preview

e-Library read for
1 day

Standards Content (sample)

SLOVENSKI STANDARD
SIST EN ISO/IEC 27006:2021
01-februar-2021
Informacijska tehnologija - Varnostne tehnike - Zahteve za organe, ki izvajajo

presojanje in certificiranje sistemov upravljanja informacijske varnosti (ISO/IEC

27006:2015, vključno z dopolnilom 1:2020)

Information technology - Security techniques - Requirements for bodies providing audit

and certification of information security management systems (ISO/IEC 27006:2015,

including Amd 1:2020)

Informationstechnik - IT-Sicherheitsverfahren - Anforderungen an Institutionen, die Audits

und Zertifizierungen von Informationssicherheits-Managmentsystemen anbieten
(ISO/IEC 27006:2015, einschließlich Amd 1:2020)

Technologies de l'information - Techniques de sécurité - Exigences pour les organismes

procédant à l'audit et à la certification des systèmes de management de la sécurité de

l'information (ISO/IEC 27006:2015, y compris Amd 1:2020)
Ta slovenski standard je istoveten z: EN ISO/IEC 27006:2020
ICS:
03.100.70 Sistemi vodenja Management systems
03.120.20 Certificiranje proizvodov in Product and company
podjetij. Ugotavljanje certification. Conformity
skladnosti assessment
35.030 Informacijska varnost IT Security
SIST EN ISO/IEC 27006:2021 en,fr,de

2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

---------------------- Page: 1 ----------------------
SIST EN ISO/IEC 27006:2021
---------------------- Page: 2 ----------------------
SIST EN ISO/IEC 27006:2021
EUROPEAN STANDARD
EN ISO/IEC 27006
NORME EUROPÉENNE
EUROPÄISCHE NORM
November 2020
ICS 03.120.20; 35.030
English version
Information technology - Security techniques -
Requirements for bodies providing audit and certification
of information security management systems (ISO/IEC
27006:2015, including Amd 1:2020)

Technologies de l'information - Techniques de sécurité Informationstechnik - IT-Sicherheitsverfahren -

- Exigences pour les organismes procédant à l'audit et Anforderungen an Institutionen, die Audits und

à la certification des systèmes de management de la Zertifizierungen von Informationssicherheits-

sécurité de l'information (ISO/IEC 27006:2015, y Managmentsystemen anbieten (ISO/IEC 27006:2015,

compris Amd 1:2020) einschließlich Amd 1:2020)
This European Standard was approved by CEN on 16 November 2020.

CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for

giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical

references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to

any CEN and CENELEC member.

This European Standard exists in three official versions (English, French, German). A version in any other language made by

translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC

Management Centre has the same status as the official versions.

CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium,

Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,

Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia,

Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and United Kingdom.
CEN-CENELEC Management Centre:
Rue de la Science 23, B-1040 Brussels

© 2020 CEN/CENELEC All rights of exploitation in any form and by any means Ref. No. EN ISO/IEC 27006:2020 E

reserved worldwide for CEN national Members and for
CENELEC Members.
---------------------- Page: 3 ----------------------
SIST EN ISO/IEC 27006:2021
EN ISO/IEC 27006:2020 (E)
Contents Page

European foreword ....................................................................................................................................................... 3

---------------------- Page: 4 ----------------------
SIST EN ISO/IEC 27006:2021
EN ISO/IEC 27006:2020 (E)
European foreword

The text of ISO/IEC 27006:2015 has been prepared by Technical Committee ISO/IEC JTC 1 "Information

technology” of the International Organization for Standardization (ISO) and has been taken over as

EN ISO/IEC 27006:2020 by Technical Committee CEN/CLC/JTC 13 “Cybersecurity and Data Protection”

the secretariat of which is held by DIN.

This European Standard shall be given the status of a national standard, either by publication of an

identical text or by endorsement, at the latest by May 2021, and conflicting national standards shall be

withdrawn at the latest by May 2021.

Attention is drawn to the possibility that some of the elements of this document may be the subject of

patent rights. CEN shall not be held responsible for identifying any or all such patent rights.

According to the CEN-CENELEC Internal Regulations, the national standards organizations of the

following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,

Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland,

Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of

North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and the

United Kingdom.
Endorsement notice

The text of ISO/IEC 27006:2015 has been approved by CEN as EN ISO/IEC 27006:2020 without any

modification.
---------------------- Page: 5 ----------------------
SIST EN ISO/IEC 27006:2021
---------------------- Page: 6 ----------------------
SIST EN ISO/IEC 27006:2021
INTERNATIONAL ISO/IEC
STANDARD 27006
Third edition
2015-10-01
Information technology — Security
techniques — Requirements
for bodies providing audit and
certification of information security
management systems
Technologies de l’information — Techniques de sécurité — Exigences
pour les organismes procédant à l’audit et à la certification des
systèmes de management de la sécurité de l’information
Reference number
ISO/IEC 27006:2015(E)
ISO/IEC 2015
---------------------- Page: 7 ----------------------
SIST EN ISO/IEC 27006:2021
ISO/IEC 27006:2015(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2015, Published in Switzerland

All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form

or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior

written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of

the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. +41 22 749 01 11
Fax +41 22 749 09 47
copyright@iso.org
www.iso.org
ii © ISO/IEC 2015 – All rights reserved
---------------------- Page: 8 ----------------------
SIST EN ISO/IEC 27006:2021
ISO/IEC 27006:2015(E)
Contents Page

Foreword ..........................................................................................................................................................................................................................................v

Introduction ................................................................................................................................................................................................................................vi

1 Scope ................................................................................................................................................................................................................................. 1

2 Normative references ...................................................................................................................................................................................... 1

3 Terms and definitions ..................................................................................................................................................................................... 1

4 Principles ..................................................................................................................................................................................................................... 1

5 General requirements ..................................................................................................................................................................................... 2

5.1 Legal and contractual matters ................................................................................................................................................... 2

5.2 Management of impartiality ........................................................................................................................................................ 2

5.2.1 IS 5.2 Conflicts of interest ........................................................................................................................................ 2

5.3 Liability and financing ...................................................................................................................................................................... 2

6 Structural requirements .............................................................................................................................................................................. 2

7 Resource requirements ................................................................................................................................................................................. 2

7.1 Competence of personnel .............................................................................................................................................................. 2

7.1.1 IS 7.1.1 General considerations ........................................................................................................................... 3

7.1.2 IS 7.1.2 Determination of Competence Criteria .................................................................................... 3

7.2 Personnel involved in the certification activities ...................................................................................................... 6

7.2.1 IS 7.2 Demonstration of auditor knowledge and experience .................................................... 6

7.3 Use of individual external auditors and external technical experts .......................................................... 7

7.3.1 IS 7.3 Using external auditors or external technical experts as part of the

audit team .............................................................................................................................................................................. 7

7.4 Personnel records................................................................................................................................................................................. 7

7.5 Outsourcing................................................................................................................................................................................................ 7

8 Information requirements ......................................................................................................................................................................... 8

8.1 Public information ............................................................................................................................................................................... 8

8.2 Certification documents .................................................................................................................................................................. 8

8.2.1 IS 8.2 ISMS Certification documents ............................................................................................................... 8

8.3 Reference to certification and use of marks .................................................................................................................. 8

8.4 Confidentiality ......................................................................................................................................................................................... 8

8.4.1 IS 8.4 Access to organizational records ........................................................................................................ 8

8.5 Information exchange between a certification body and its clients ......................................................... 8

9 Process requirements ..................................................................................................................................................................................... 8

9.1 Pre-certification activities ............................................................................................................................................................. 8

9.1.1 Application ............................................................................................................................................................................ 8

9.1.2 Application review ......................................................................................................................................................... 9

9.1.3 Audit programme ............................................................................................................................................................ 9

9.1.4 Determining audit time ...........................................................................................................................................10

9.1.5 Multi-site sampling .....................................................................................................................................................10

9.1.6 Multiple management systems .........................................................................................................................11

9.2 Planning audits ....................................................................................................................................................................................11

9.2.1 Determining audit objectives, scope and criteria .............................................................................11

9.2.2 Audit team selection and assignments ......................................................................................................12

9.2.3 Audit plan ............................................................................................................................................................................12

9.3 Initial certification ............................................................................................................................................................................13

9.3.1 IS 9.3.1 Initial certification audit .....................................................................................................................13

9.4 Conducting audits ..............................................................................................................................................................................14

9.4.1 IS 9.4 General ...................................................................................................................................................................14

9.4.2 IS 9.4 Specific elements of the ISMS audit ..............................................................................................14

9.4.3 IS 9.4 Audit report .......................................................................................................................................................14

9.5 Certification decision ......................................................................................................................................................................15

9.5.1 IS 9.5 Certification decision .................................................................................................................................15

© ISO/IEC 2015 – All rights reserved iii
---------------------- Page: 9 ----------------------
SIST EN ISO/IEC 27006:2021
ISO/IEC 27006:2015(E)

9.6 Maintaining certification .............................................................................................................................................................15

9.6.1 General...................................................................................................................................................................................15

9.6.2 Surveillance activities ...............................................................................................................................................15

9.6.3 Re-certification ...............................................................................................................................................................16

9.6.4 Special audits ...................................................................................................................................................................17

9.6.5 Suspending, withdrawing or reducing the scope of certification .......................................17

9.7 Appeals .......................................................................................................................................................................................................17

9.8 Complaints ...............................................................................................................................................................................................17

9.8.1 IS 9.8 Complaints ..........................................................................................................................................................17

9.9 Client records ........................................................................................................................................................................................17

10 Management system requirements for certification bodies ...............................................................................17

10.1 Options ........................................................................................................................................................................................................17

10.1.1 IS 10.1 ISMS implementation .............................................................................................................................17

10.2 Option A: General management system requirements .....................................................................................17

10.3 Option B: Management system requirements in accordance with ISO 9001.................................17

Annex A (informative) Knowledge and skills for ISMS auditing and certification .............................................18

Annex B (normative) Audit time ............................................................................................................................................................................20

Annex C (informative) Methods for audit time calculations .....................................................................................................25

Annex D (informative) Guidance for review of implemented ISO/IEC 27001:2013,

Annex A controls ................................................................................................................................................................................................28

Bibliography .............................................................................................................................................................................................................................35

iv © ISO/IEC 2015 – All rights reserved
---------------------- Page: 10 ----------------------
SIST EN ISO/IEC 27006:2021
ISO/IEC 27006:2015(E)
Foreword

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical

Commission) form the specialized system for worldwide standardization. National bodies that are

members of ISO or IEC participate in the development of International Standards through technical

committees established by the respective organization to deal with particular fields of technical

activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international

organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the

work. In the field of information technology, ISO and IEC have established a joint technical committee,

ISO/IEC JTC 1.

The procedures used to develop this document and those intended for its further maintenance are

described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for

the different types of document should be noted. This document was drafted in accordance with the

editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).

Attention is drawn to the possibility that some of the elements of this document may be the subject

of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent

rights. Details of any patent rights identified during the development of the document will be in the

Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents).

Any trade name used in this document is information given for the convenience of users and does not

constitute an endorsement.

For an explanation on the meaning of ISO specific terms and expressions related to conformity

assessment, as well as information about ISO’s adherence to the WTO principles in the Technical

Barriers to Trade (TBT) see the following URL: Foreword - Supplementary information

The committee responsible for this document is ISO/IEC JTC 1, Information technology, SC 27, IT

Security techniques.

ISO/IEC 27006 was prepared by the Joint Technical Committee ISO/IEC JTC 1, Information technology,

Subcommittee SC 27, IT Security techniques.

This third edition cancels and replaces the second edition (ISO/IEC 27006:2011), which has been

technically revised.
© ISO/IEC 2015 – All rights reserved v
---------------------- Page: 11 ----------------------
SIST EN ISO/IEC 27006:2021
ISO/IEC 27006:2015(E)
Introduction

ISO/IEC 17021-1 sets out criteria for bodies operating audit and certification of management systems. If

such bodies are to be accredited as complying with ISO/IEC 17021-1 with the objective of auditing and

certifying information security management systems (ISMS) in accordance with ISO/IEC 27001:2013,

some additional requirements and guidance to ISO/IEC 17021-1 are necessary. These are provided by

this International Standard.

The text in this International Standard follows the structure of ISO/IEC 17021-1 and the additional

ISMS-specific requirements and guidance on the application of ISO/IEC 17021-1 for ISMS certification

are identified by the letters “IS”.

The term “shall” is used throughout this International Standard to indicate those provisions which,

reflecting the requirements of ISO/IEC 17021-1 and ISO/IEC 27001, are mandatory. The term “should” is

used to indicate recommendation.

The primary purpose of this International Standard is to enable accreditation bodies to more effectively

harmonize their application of the standards against which they are bound to assess certification bodies.

Throughout this International Standard, the terms “management system” and “system” are used

interchangeably. The definition of a management system can be found in ISO 9000:2005. The

management system as used in this International Standard is not to be confused with other types of

systems, such as IT systems.
vi © ISO/IEC 2015 – All rights reserved
---------------------- Page: 12 ----------------------
SIST EN ISO/IEC 27006:2021
INTERNATIONAL STANDARD ISO/IEC 27006:2015(E)
Information technology — Security techniques —
Requirements for bodies providing audit and certification
of information security management systems
1 Scope

This International Standard specifies requirements and provides guidance for bodies providing

audit and certification of an information security management system (ISMS), in addition to the

requirements contained within ISO/IEC 17021-1 and ISO/IEC 27001. It is primarily intended to support

the accreditation of certification bodies providing ISMS certification.

The requirements contained in this International Standard need to be demonstrated in terms of

competence and reliability by any body providing ISMS certification, and the guidance contained in

this International Standard provides additional interpretation of these requirements for any body

providing ISMS certification.

NOTE This International Standard can be used as a criteria document for accreditation, peer assessment or

other audit processes.
2 Normative references

The following documents, in whole or in part, are normatively referenced in this document and are

indispensable for its application. For dated references, only the edition cited applies. For undated

references, the latest edition of the referenced document (including any amendments) applies.

ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies providing audit and certification

of management systems — Part 1: Requirements

ISO/IEC 27000, Information technology — Security techniques — Information security management

systems — Overview and vocabulary

ISO/IEC 27001:2013, Information technology — Security techniques — Information security management

systems — Requirements
3 Terms and definitions

For the purposes of this document, the terms and definitions given in ISO/IEC 17021-1, ISO/IEC 27000

and the following apply.
3.1
certification documents

documents indicating that a client’s ISMS conforms to specified ISMS standards and any supplementary

documentation required under the system
4 Principles
The principles from ISO/IEC 17021-1, 4 apply.
© ISO/IEC 2015 – All rights reserved 1
---------------------- Page: 13 ----------------------
SIST EN ISO/IEC 27006:2021
ISO/IEC 27006:2015(E)
5 General requirements
5.1 Legal and contractual matters
The requirements of ISO/IEC 17021-1, 5.1 apply.
5.2 Management of impartiality

The requirements of ISO/IEC 17021-1, 5.2 apply. In addition, the following requirements and

guidance apply.
5.2.1 IS 5.2 Conflicts of interest

Certification bodies may carry out the following duties without them being considered as consultancy

or having a potential conflict of interest:

a) arranging and participating as a lecturer in training courses, provided that, where these

courses relate to information security management, related management systems or auditing,

certification bodies shall confine themselves to the provision of generic information and advice

which is publicly available, i.e. they shall not provide company-specific advice which contravenes

the requirements of b) below;

b) making available or publishing on request information describing the certification body’s

interpretation of the requirements of the certification audit standards (see 9.1.3.6);

c) activities prior to audit, solely aimed at determining readiness for certification audit; however, such

activities shall not result in the provision of recommendations or advice that would contravene this

clause and the certification body shall be able to confirm that such activities do not contravene

these requirements and that they are not used to justify a reduction in the eventual certification

audit duration;

d) performing second and third-party audits according to standards or regulations other than those

being part of the scope of accreditation;

e) adding value during certification audits and surveillance visits, e.g. by identifying opportunities for

improvement, as they become evident during the audit, without recommending specific solutions.

The certification body shall not provide internal information security reviews of the client’s ISMS

subject to certification. Furthermore, the certification body shall be independent from the body or

bodies (including any individuals) which provide the internal ISMS audit.
5.3 Liability and financing
The requirements of ISO/IEC 17021-1, 5.3 apply.
6 Structural requirements
The requirements of ISO/IEC 17021-1, 6 apply.
7 Resource requirements
7.1 Competence of personnel

The requirements of ISO/IEC 17021-1, 7.1 apply. In addition, the following requirements and

guidance apply.
2 © ISO/IEC 2015 – All rights reserved
---------------------- Page: 14 ----------------------
SIST EN ISO/IEC 27006:2021
ISO/IEC 27006:2015(E)
7.1.1 IS 7.1.1 General considerations
7.1.1.1 Generic competence requirements

The certification body shall ensure that it has knowledge of the technological, legal and regulatory

developments relevant to the ISMS of the client which it assesses.

The certification body shall define the competence requirements for each certification function as

referenced in Table A.1 of ISO/IEC 17021-1. The certification body shall take into account all the

requirements specified in ISO/IEC 17021-1 and 7.1.2 and 7.2.1 of this International Standard that are

relevant for the ISMS technical areas as determined by the certification body.

NOTE Annex A provides a summary of the competence requirements for personnel involved in specif

...

Questions, Comments and Discussion

Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.