SIST ISO/IEC 27006:2018
Information technology -- Security techniques -- Requirements for bodies providing audit and certification of information security management systems
Information technology -- Security techniques -- Requirements for bodies providing audit and certification of information security management systems
This International Standard specifies requirements and provides guidance for bodies providing
audit and certification of an information security management system (ISMS), in addition to the
requirements contained within ISO/IEC 17021-1 and ISO/IEC 27001. It is primarily intended to support
the accreditation of certification bodies providing ISMS certification.
The requirements contained in this International Standard need to be demonstrated in terms of
competence and reliability by any body providing ISMS certification, and the guidance contained in
this International Standard provides additional interpretation of these requirements for any body
providing ISMS certification.
NOTE This International Standard can be used as a criteria document for accreditation, peer assessment or
other audit processes.
Technologies de l'information -- Techniques de sécurité -- Exigences pour les organismes procédant à l'audit et à la certification des systèmes de management de la sécurité de l'information
La présente Norme internationale spécifie les exigences et fournit des recommandations pour les organismes procédant ŕ l'audit et ŕ la certification d'un systčme de management de la sécurité de l'information (SMSI), en plus des exigences contenues dans l'ISO/IEC 17021‑1 et l'ISO/IEC 27001. Elle a pour principal objet de soutenir l'accréditation des organismes de certification qui procčdent ŕ la certification de SMSI.
Il est nécessaire que tout organisme qui procčde ŕ la certification de SMSI démontre qu'il respecte les exigences stipulées dans la présente Norme internationale en termes de compétences et de fiabilité, et les recommandations contenues dans la présente Norme internationale fournissent une interprétation supplémentaire de ces exigences pour tout organisme procédant ŕ la certification de SMSI.
NOTE La présente Norme internationale peut ętre utilisée comme référentiel pour l'accréditation, l'évaluation par des pairs ou d'autres processus d'audit.
Informacijska tehnologija - Varnostne tehnike - Zahteve za organe, ki izvajajo presojanje in certificiranje sistemov upravljanja informacijske varnosti
Ta mednarodni standard določa zahteve in podaja navodila za organe, ki izvajajo presojanje in certificiranje sistemov upravljanja informacijske varnosti (ISMS), ter se uporablja kot dodatek k zahtevam, določenim v standardih ISO/IEC 17021-1 in ISO/IEC 27001. Uporablja se predvsem kot podpora
za akreditacijo certifikacijskih organov, ki izvajajo certifikacijo ISMS.
Za izpolnjevanje zahtev, ki jih vsebuje ta mednarodni standard, mora vsak organ, ki izvaja certifikacijo ISMS, izkazati kompetentnost in zanesljivost, navodila v tem mednarodnem standardu pa podajajo dodatno interpretacijo teh zahtev za vsak organ, ki izvaja certifikacijo ISMS.
OPOMBA: Ta mednarodni standard se lahko uporablja kot dokument z merili za akreditacijo, medsebojno ocenjevanje ali druge procese presojanja.
General Information
Relations
Buy Standard
Related Packages
Standards Content (Sample)
ةيلودلا ةيسايقلا ةفصاوملا
ةينقتورهكلا ةيلودلا ةنجللا /وزـــيأ
60772
ةيمسرلا ةمجرتلا
Official translation
Tradition officials
ثلاثلا رادصلإا
5102-01-10
قيقدتلا تاهج تابلطتم – نملأا تاينقت -- تامولعملا ايجولونكت
تامولعملا نمأ ةرادإ مظنل تاداهشلا رادصإو
Information technology — Security techniques — Requirements for bodies
providing audit and certification of information security management
systems (E)
Technologies de l’information — Techniques de sécurité — Exigences
pour les organismes procédant à l’audit et à la certification dessystèmes de
management de la sécurité de l’information(F)
يف ةمئاقلا رظنا( ةمجرتلا ةقد تدمتعأ يتلاISO يف ءاضعأ تائيه01نع ةبانلإاب ةيمسر ةيبرع ةمجرتك ارسيوس ،فينج يف ISO ةيزكرملا ةناملأا يف تعبط
.)ii ةحفص
ىعجرملا مقرلا
ISO\IEC 27006:2015 (A)
ةيمسرلا ةمجرتلا
©ISO 2015
---------------------- Page: 1 ----------------------
)ع( 5102/50112 يس يإ يأ/وزيأ
)هيونت( ةيلوئسم ءلاخإ
اذنه ةنعابط ننكمي هنإف Adobe ـل صيخرتلا ةسايس بجومبو ،ةجمدُم طوطخ ىلع )PDF( فلملا اذه يوتحي دق
متي يذلا بوساحلا يف ةلَّمحُمو ةصخرُمهيف ةجمدُملا طوطخلا نكت مل ام هليدعت متي َّلاأ ىلع ،هيلععلاطلاا وأ فلملا
ينف ،Adobe ـل صيخرتلا ةسايسب للاخلإا مدع ةيلوئسم - فلملا اذه ليزنت دنع - فارطلأا لمحتت و.ليدعتلا هيف
.لاجملا اذه لايح ةينوناق ةيلوئسم يأ لمحتت لاوزيلألةماعلا ةيراتركسلا نأنيح
Adobe.ـلا مظنل ةدحتملا ةكرشلل ةلجسم ةيراجت ةملاع Adobe ـلا دعت
ةنماعلا تانمولعملا ننم فنلملا اذنه ءانشنإ ينف ةمدختنسملا مماربلانب ةنصاخلا لينصافتلا نيمج ينلع لوصحلا نكمي
نونكي نأ ينعوُر ثنيح ،)PDF( ءانشنإ يف ةلخادلا تاريغتملا تن سُح دقف ةعابطلا لجلأو ، )PDF(فلمب ةقلعتملا
، فنلملا اذنهب لنلعتت ةلكنشم يأ شودنح ةنلاح ينفو ، ينيقتلل ةنيلودلا ةنمظنملا ءاضعلأ امئلام فلملا اذه مادختسا
.هاندأ لجسملا ناونعلا ىلع ةماعلا ةيراتركسلا غلابإ ىجرُي
ةفصاوملا تدمتعا يتلا ةيبرعلا سييقتلا تاهج
ندرلأا
ةيندرلأا سيياقملاو تافصاوملا ةسسؤم
تاراملإا
سيياقملاو تافصاوملل تاراملإا ةئيه
رئازجلا
سييقتلل يرئازجلا دهعملا
ةيدوعسلا
سيياقملاو تافصاوملل ةيدوعسلا ةئيهلا
قارعلا
ةيعونلا ةرطيسلاو سييقتلل يزكرملا زاهجلا
تيوكلا
ةعانصلل ةماعلا ةئيهلا
نادوسلا
سيياقملاو تافصاوملل ةينادوسلا ةئيهلا
نميلا
ةدوجلا طبضو سيياقملاو تافصاوملل ةينميلا ةئيهلا
سنوت
ةيعانصلا ةيكلملاو تافصاوملل ينطولا دهعملا
ايروس
ةيروسلا ةيبرعلا سيياقملاو تافصاوملا ةئيه
ايبيل
ةيسايقلا ريياعملاو تافصاوملل ينطولا زكرملا
رصم
ةدوجلاو تافصاوملل ةماعلا ةيرصملا ةئيهلا
رشنلاو عبطلا قوقح ةيامح ةقيثو
©5102وزيأ
ةليسو يأب وأ لكش يأب همادختسا وأ رادصلإا اذه نم ءزج يأ جاتنإ ةداعإ زوجي لا ،كلذ فلاخ دري كل امو .ةظوفحم قوقحلا يمج
دحا وأ هاندأ ناونعلا ىلع ييقتلل ةيلودلا ةمظنملا نم امإ يطخ نذإ نود ةقيقدلا ملافلأاو خسنلا كلذ يف امب ةيكيناكيم وأ ةينورتكلا
.ةبلاطلا ةهجلا ةلود يف ييقتلل ةيلودلا ةمظنملا يف ءاضعلأا تائيهلا
ييقتلل ةيلودلا ةمظنملا ةيكلم قوقح بتكم
51 فينج -Ch-1211- 22 :يديربلا زمرلا
1120550221000 :فتاه
1120550221220 : كاف
copyright@iso.org :ينورتكلا ديرب
www.iso.org :ينورتكللاا قوملا
5100يف ةيبرعلاةخسنلا رشن مت
ارسيوس يف رشنلا مت
© ISO 2015 - ةظوفحم قوقحلا عيمج ii
---------------------- Page: 2 ----------------------
)ع( 5102/50112يس يإ يأ / وزيأ
تايوتحملا
v .ديهمت
iv . . ةمدقم
1 . لاجملا -1
1 . ةيليمكتلا عجارملا -6
1 . فيراعتلاو تاحلطصملا -3
1 . ئدابملا -4
. 6 ةماعلا تابلطتملا -5
. 5 ةيدقاعتلاو ةينوناقلا نوئشلا 0/2
. 5 . ةيدايحلا ةرادإ 5/2
5 . )حلاصملا( تامامتهلاا ضراعت5/2 مأ 0/5/2
. 5 ليومتلاو تامازتللاا 3/2
. 6 ةيلكيهلا تابلطتملا -2
. 3 دراوملا تابلطتم -0
3 . دارفلأا تاءافك0/0
3 . ةماع تارابتعا 0/0/0
. 3 . رادتقلاا ريياعم ديدحت 5/0/0
2 . ليدصتلا تاطاشن يف نوكراشملا دارفلأا 5/0
2 . لقدملا تاربخو فراعم نايب 0/5/0
0 . جراخلا نم نيينفلا ءاربخلاو جراخلا نم دارفلأا نيققدملا مادختسا 3/0
0 . ليقدتلا ليرف نمءزجك جراخلا نم نيينفلا ءاربخلاو جراخلا نم نيققدملا مادختسا 0/3/0
.0 . نيلماعلا تلاجس 2 /0
0 . ةمظنملا جراخ نم نيلماعلاب ةناعتسلاا 2/0
0 . تامولعملا تابلطتم -8
0 . ةماعلا تامولعملا0/8
0 . ليدصتلا تادنتسم5/8
0 . تامولعملا نمأ ةرادإ ماظن تاداهش لئاثو0/5/8
8 . تاملاعلا مادختساو ةداهشلا ىلإ ةراشلإا 3/8
8 . ةيرسلا2/8
8 . ةيميظنتلا تلاجسلا ىلإ لوصولا 0/2/8
8 . اهئلامعو تاداهشلا رادصإ ةهج نيب تامولعملا لدابت 2/8
8 . تايلمعلا تابلطتم -9
8 . ليدصتلا / حنملا لبق ام تابلطتم 0/2
8 . ليبطتلا ميدقت 0/0/2
8 . ليبطتلا ةعجارم5/0/2
8 . ةعجارملا ممانرب3/0/2
01 . ليقدتلا نمز ديدحت2/0/2
00 . قاوملا ددعت لظ يف تانيعلا 2/0/2
00 . ةرادلإا مظن ددعت2/0/2
00 . تاقيقدتلا طيطخت5/2
00 . هريياعمو هلاجمو ليقدتلا فادهأ ديدحت0/5/2
00 . هئاضعأ تافيلكت ديدحتو ليقدتلا ليرفرايتخا5/5/2
05 . ليقدتلا ةطخ3/5/2
05 . ىلولأا ليدصتلا3/2
05 . ىلولأا تاداهشلا حنم ليقدت 0/3/2
03 . تاقيقدتلا ءارجإ 2/2
03 . ماع0/2/2
iii
ISO 2015 © ةظوفحم قوقحلا عيمج
---------------------- Page: 3 ----------------------
)ع( 5102/50112 يس يإ يأ/وزيأ
03 . تامولعملا نمأةرادإ مظن ليقدتل ةصاخلارصانعلا 5/2/2
03 . ليقدتلا ريرقت 3/2/2
03 . ليدصتلا رارق 2/2
02 . ليدصتلا رارق0/2/2
02 . ليدصتلا ةنايص 2/2
02 . ماع0/2/2
02 .ةبقارملا ليقدت5/2/2
02 . ةداهشلا رادصا 3/2/2
02 . ةصاخلا تاقيقدتلا 2/2/2
02 . ةداهشلا لاجم صيلقتوأ بحسوأ ليلعت 2/2/2
02 . راسفتسلاا0/2
0 0 . ىواكشلا8/2
00 . ىواكشلا0/8/2
00 . ءلامعلا تلاجس2/2
10 . ةداهشلا حنم تاهجل ةرادلإا ماظن تابلطتم -17
00 . تارايخلا 0/01
00 .تامولعملا نمأ ةرادإ ماظن ليبطت0/01 مأ0/0/01
00 . ةماعلا ةرادلإا ماظن تابلطتم :أرايخلا5/01
00 . 2110وزيلاا ةفصاوملل اقبط ةماعلا ةرادلإا ماظن تابلطتم :برايخلا3/01
08 . اهيلع قيدصتلاو تامولعملا نمأ ةرادإ مظن قيقدتل ةبولطملا تاراعملاو فراعملا )يداشرتسا -أ( قحلم
51 . قيقدتلا نمز )يعجرم - ب( قحلم
52 . قيقدتلا نمز باستحا قرط )يداشرتسا - ج( قحلم
،6713/60771ىس يأ / وزيا ةفصاوملا ةعجارمب تاداشرإ )يداشرتسا - د( قحلم
.طباوضلا )ـه( قحلملاو
52
. رداصملا
30
© ISO 2015 - ةظوفحم قوقحلا عيمج iv
---------------------- Page: 4 ----------------------
)ع( 5102/50112يس يإ يأ / وزيأ
ديهمت
ابلاغو،)وزيلأا يف ءاضعلأا تاهجلا( ةينطولا ييقتلا تاهجل يملاع داحتا يه ) ييقتلل ةيلودلا ةمظنملا( وزيلأا
دق عوضومب مامتها اهل وضعلا ةهجلا تناك اذإو،وزيلأل ةينفلا ناجللا للاخ نم ةيلودلا تافصاوملا دادعإ متيام
ّ
تامظنملا كلذك لمعلا يف كراشيو.ةنجللا كلت يف لثمم هل نوكي نأ يف لحلا وضعلا اذهل نإف ،ةينف ةنجل هل تل كُش
ةيلودلا ةنجللا م اقيثو انواعت وزيلأا نواعتتو.وزيلأا م لصاوت اهل يتلا ،ةيموكحلا ريغو اهنم ةيموكحلا ةيلودلا
.ينقت ورهكلا لاجملا يف ييقتلا مهت يتلا روملأا يمج يف )IEC( ةينقتورهكلا
.يناثلا ءزجلا - يس يإ يأ/وزيلأا تاهيجوت يف ةدراولا حئاولل اقفو ةيلودلا تافصاوملا غاصتو
تائيهلا ىلع ةيلودلا تافصاوملا يراشم يزوت متيو .ةيلودلا تافصاوملا دادعا وه ةينفلا ناجلل ةيسيئرلا ةمهملا
ةينطولا تائيهلا نم لقلأا ىلع %02 ةقفاوم ةيلود تافصاومك يراشملا هذه رادصا بلطتيو.تيوصتلل ةينطولا
.تيوصتلا اهل لحي يتلا
لنمحتت ننلو .عارنتخلاا ةءارنب قونقحل ةعنضاخ ةنقيثولا هذه رصانع ضعب نوكت نأ ةيلامتحا ىلإ هابتنلاا تفل دونو
.اهعيمج وأ قوقحلا هذه نم ّيأ ديدحت ةيلوؤسم (ISO) ييقتلل ةيلودلا ةمظنملا
ةكرتشملا ب ةصاخلا ،ةينفلا ةنجللا ةطساوب 50112ةينقت ورهكلا ةيلودلا ةنجللا /وزـــيلأا ةفصاوم دادعإ مت دقو
ISO / IEC JTC 1ةيعرفلا ةنجللا ،تامولعملا ايجولونكت ، SC 27نملأا تاينقت ،.
،ةينفلا ةيحانلا نم اهحيقنت مت ثيح (ISO / IEC 27006: 2011) ةيناثلا ةعبطلا ،ةثلاثلا ةعبطلا هذه ىغلت
v
ISO 2015 © ةظوفحم قوقحلا عيمج
---------------------- Page: 5 ----------------------
)ع( 5102/50112 يس يإ يأ/وزيأ
ةمدقم
ةرادلإا مظنل تاداهشلا حنمو ليقدت ىلع ةمئاقلا تاهجلل ريياعملا 00150 يس يإ يا /وزيا ةفصاوملا ضت
حنمو ليقدت فدهب 00150 ىس يإ يا /وزيا ةفصاوملل ةلثتممك دمتعت نأ تامظنملا هذهل ناك نإف .تامظنملل
كانه نإف ،5112 :50110 ىس ىإ يا /وزيا ةفصاوملل اقبط(ISMS) تامولعملا نمأ ةرادإ مظنل ةداهشلا
ةفصاوملا هذه همدقت ام وهو .00150 ىس ىإ يا /وزيا ةفصاوملل ةيرورض ةيفاضإ تاداشرإو تابلطتم
.ةيلودلا
تابلطتملا زييمت مت دقو ،00150 ىس ىإ يا /وزيا ةفصاوملا لكيه فن ةيلودلا ةفصاوملا هذه يف صنلا بتي
ىس ىإ يا /وزيا ةفصاوملا ليبطت دنع(ISMS) تامولعملا نمأ ةرادإ مظنب ةصاخلا ةيفاضلإا تاداشرلإاو
." م أ " “IS”فرحلأاب (ISMS) تامولعملا نمأ ةرادإ مظنل تاداهشلا حنم ىف ،0-00150
نيتفصاوملا تابلطتم ةيمازلإ كعت يتلا ماكحلأا كلت نايبل ةيلودلا ةفصاوملا هذه ىف " بجي " ريبعتلا مدختسي
ةيصوتلا ىنعم لمحيل " يغبني " ريبعتلا مدختسي اميف .50110 ىس ىإ يا /وزياو00150 ىس ىإ يا /وزيا
.ليضفتلاو حصنلاو
يتلا ريياعملل اهقيبطت يف ةيلاعف رثكأ مغانت نم دامتعلاا تاهج نيكمت وه ةيلودلا ةفصاوملا هذهل ىلولأا فدهلاو
.)تاداهشلا حنم( ليدصتلا تاهج مييقت دنع اهب مزتلت
دراو ةرادلإا ماظن فيرعت .لدابتلاب " ماظنلا"و "ةرادلإا ماظن" ناحلطصملا مدختسي ةيلودلا ةفصاوملا هذه للاخ
يف مدختسم وه امك "ةرادلإا ماظن" ،ىقتلملا ىلع طلتخي نأ يغبني لاو .5112 :2111 وزيا ةيلودلا ةفصاوملاب
.تامولعملا ةينقت ماظن لثم ىرخلأا ةمظنلأا عاونأ م ةيلودلا ةفصاوملا هذه
© ISO 2015 - ةظوفحم قوقحلا عيمج vi
---------------------- Page: 6 ----------------------
)ع( 5102/50112يس يإ يأ / وزيأ
قيقدتلا تاهج تابلطتم – نملأا تاينقت - تامولعملا ايجولونكت
تامولعملا نمأ ةرادإ مظنل )تاداهشلا رادصإ( قيدصتلاو
لاجملا -1
ننمأ ةرادإ مظننل تاداهنشلا رادنصإو ليقدنتلا ميدقت تاهجل تاداشرلإا مدقتو تابلطتملا ةيلودلا ةفصاوملا هذه ددحت
يس ىإ يا /وزيا ةفصاوملاو00150 ىس ىإ يا /وزيا ةفصاوملا يف ةدراولا تابلطتملا ىلإ ةفاضلإاب تامولعملا
تاداهنشلا ردنصت ينتلا )تاداهشلا حنم( ليدصتلا تاهج دامتعا معدوه لولأا ماقملا يف انه دوصقملاو .50110
.ISMSتامولعملا نمأ ةرادإ مظنل
موقت ةهج يأ لبق نم ،ةيدامتعلااورادتقلاا ةللادب اهراهظإ ىلإ ةجاحب ةيلودلا ةفصاوملا هذه يف ةدراولا تابلطتملا
ةيفانضإ تارينسفت ةنيلودلا ةفنصاوملا هذنه ينف ةدراونلا تادانشرلإا مدنقتو ،تامولعملا نمأ ةرادإ مظن تاداهش حنمب
تاداهشلل ةحنام ةهج يلأ تابلطتملا كلتل
كنلذ رنيغ وأ نارنقلأا لنبق ننم مينيقتلل وأ دانمتعلال رييانعم ةقيثوك / دنتسمك ةيلودلا ةفصاوملا هذه مدختست نأ نكمي :ةظوحلم
.ليقدتلا تايلمع نم
ةيليمكتلا عجارملا -6
دنعاهنع ضوع لاو ،ةفصاوملا هذهل ةيرايعم جارمك تمدختسا ،اهنم ءازجأ وأ اهلماكب ،ةيلاتلا تادنتسملا
رادصلإاب دتعي كلذ ادع اميفو انه هركذ دراولا رادصلإاب طقف دتعي ،)ةاغلم( ةميدق جارمل ةراشلإا دنعو . ليبطتلا
.)رابتعلاا يف تاحيحصت وأ تلايدعت ةيأ ذخأ م( اهيلإ راشملا جارملا نم ريخلأا
ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies
providing audit and certification of management systems — Part 1: Requirements
ISO/IEC 27000, Information technology — Security techniques — Information
security management systems — Overview and vocabulary
ISO/IEC 27001:2013, Information technology — Security techniques —
Information security management systems — Requirements
فيراعتلاو تاحلطصملا -3
00150 ىس ىإ يا /وزيا ةيلودلا ةفصاوملا يف ةدراولا فيراعتلاو تاحلطصملا يرست ةفصاوملا هذه ضارغلأ
:ةيلاتلا تاحلطصملا بناج ىلإ 50111 ىس ىإ يا /وزيا ةيلودلا ةفصاوملا يف ةدراولاو
قيدصتلا تادنتسم 1/3
تانمولعملا ننمأ ةرادإ مانظن تافنصاومل لبانطم لنيمعلا ةنمظنملل تانمولعملا ننمأ ةرادإ ماظن نأ ةنيبملا تادنتسملا
.ماظنلل اقبط ةبولطم ةيفاضإ لئاثو يأو ةددحملا
ئدابملا -4
2 دنبلا يف ،0-00150 يسيإ يا /وزيا ةفصاوملا يف ةدراولا ئدابملا لبطنت
0
ISO 2015 © ةظوفحم قوقحلا عيمج
---------------------- Page: 7 ----------------------
)ع( 5102/50112 يس يإ يأ/وزيأ
ةماعلا تابلطتملا - 5
ةيدقاعتلاو ةينوناقلا نوئشلا 1/5
0/2 دنبلا يف ،0-00150 يس يإ يا /وزيا ةفصاوملا يف ةدراولا تابلطتملا لبطنت
ةيدايحلا ةرادإ 6/5
تابلطتملا ىلإ ةفاضلإاب ،5/2 دنبلا يف ،0-00150 يس يإ يا /وزيا ةفصاوملا يف ةدراولا تابلطتملا لبطنت
.تامولعملا نمأ ةرادإ ماظنب ةصاخلا ةيلاتلا تاهيجوتلاو
)حلاصملا( تامامتهلاا ضراعت 6/5 م أ 1/6/5
يف لمتحملا ضراعتلاوأ تاراشتسلاا ليبق نم دعت نأ نود ةيلاتلا ماهملا ءارجإ تاداهشلا حنم تاهجل نكمي
:تامامتهلاا
ةقلاع تاذ تارودلا هذه تناك اذإ ،هنأ ةطيرش ،ةيبيردت تارود يف رضاحمك ةكراشملاو بيترتلا )أ
تامولعملا ميدقت ىلع حنملا تاهج رصتقت ،ليقدتلاوأ ةلصلا تاذ ةرادلإا مظن وأ ،تامولعملا نمأ ةرادإب
ةكرشب ةصاخلا ةروشملا ميدقت حنملا ةهجل زوجي لا هنأ ىنعمب ،ةماع ةحاتا ةحاتملا ةروشملاو ةيساسلأا
؛ةيلاتلا )ب( ةرقفلا تابلطتم م ضراعتي امب اهنيعب
ليقدت ريياعم تابلطتمل تاداهشلارادصإ ةهج ريسفت فصت يتلا تامولعملل بلطلا دنع رشنلا وأ ةحاتلإا )ب
؛)2/3/0/2 رظنا( تاداهشلا رادصإ / حنم
حنم / رادصإ( ليدصتلا ليقدتل )ةيزهاجلا( دادعتسلاا ديدحت ىلإ طقف ةفداهلا ،ةعجارملا لبق ام ةطشنأ )ج
نأ اهنأشنم حئاصن وأ تايصوت ميدقت ىلإ ةطشنلأا هذه لثم يدؤت نأزوجي لاف ،كلذ مو ،)تاداهشلا
ةطشنلأا هذه لثم نأ ديكأت ىلع ةرداق نوكت نأ تاداهشلا رادصإ ةهج ىلع بجيو دنبلا اذه فلاخت
ةيلكلا ليقدتلا ةدم صاقتنا ىلإ ءاهتنلااريربتلا همادخت سامتي نل اهنأو تابلطتملا هذه م ضراعتتلا
؛تاداهشلا حنمل
نم اءزج دعت يتلا كلت ريغ ىرخأ تاميظنتوأ ريياعمل اقفو ثلاثلا فرطلاو يناثلا فرطلا ليقدت ءارجإ )د
؛دامتعلاا لاجم
،لاثملا ليبس ىلع ،ةبقارملا تارايز للاخو )ةداهشلا حنم( ليدصتلا ليقدت تايلمع للاخ ةميقلا ةفاضإ )ه
لولحب ةيصوتلا نود ،ةعجارملا ةيلمعءانثأ ةحضاو حبصت ثيح ،نيسحتلا صرف ديدحت ليرط نع
.اهنيعب
يلخادلا ليقدتلا مدقت يتلا )دارفلأا كلذ يف امب( تاهجلاوأ ةهجلا نع ةلقتسم تاداهشلا رادصإ ةهج نوكت نأ بجي
نع ةلقتسم ليدصتلا ةهج نوكت كلذ قوفو .حنملا ليقدتل ةعضاخلا ليمعلا ةأشنملل تامولعملا نمأ ةرادإ ماظنل
تامولعملا نمأ ةرادإ مظنل يلخادلا ليقدتلاب موقت يتلا )دارفأ نم مهيف امب( تاهجلا وأ ةهجلا
ليومتلاو تامازتللاا 3/5
.3/2 دنبلا يف ،0-00150 يسيإ يا /وزيا ةفصاوملا يف ةدراولا تابلطتملا لبطنت
ةيلكيهلا تابلطتملا - 2
.2 دنبلا يف ،0-00150 يسيإ يا /وزيا ةفصاوملا يف ةدراولا تابلطتملا لبطنت
5
© ISO 2015 - ةظوفحم قوقحلا عيمج
---------------------- Page: 8 ----------------------
)ع( 5102/50112يس يإ يأ / وزيأ
دراوملا تابلطتم - 0
دارفرلأا تاءافك 1/0
تابلطتملا لبطنت ،كلذ ىلإةفاضلإابو 0/0 دنبلا يف0-00150 يس يإ يا /وزيا يف ةدراولا تابلطتملا لبطنت
:ةيلاتلا تاهيجوتلاو
ةماع تارابتعا 1/1/0 م أ 1/1/0
ةيلولأا /ةماعلاةءافكلا تابلطتم 1/1/1/0
ماظنب ةقلاعلا تاذ ةيميظنتلاو ةينوناقلاو ةينقتلا تاروطتلاب ةفرعملا اهيدل نأ نم ليدصتلا ةهج لقحتت نأ بجي
.همييقتب موقت يذلا ليمعلل تامولعملا نمأ ةرادإ
لودجلا يف هيلإ راشملا وحنلا ىلع ليدصتلا ماهم / فئاظو نم لكل ةءافكلا تابلطتم ليدصتلا ةهج ددحت نأ بجي
يا /وزيا يف ةفصوملا تابلطتملا اهرابتعا ىف ليدصتلا ةهج ذخأت .0-00150 يسيإ يا /وزيا ةفصاوملا نم 0-أ
تامولعملا نمأ ماظنبناوجب ةقلاعلا تاذو ةيلودلا ةفصاوملا هذه نم 0/5/0و 5/0/0 تارقفلاو0-00150 يسيإ
.ليدصتلا ةهج لبق نم ددحملا وحنلا ىلع ةينقتلا
ةددحملا ليدصتلا فئاظو ىف نيكراشملا دارفلأل ةءافكلا تابلطتمل اصخلم أ لفرملا مدقي :ةظوحلم
ةءافكلا ريياعم ديدحت6/1/0 م أ 6/1/0
تامولعملا نمأ ةرادإ ماظن قيقدتلةءافكلا تابلطتم 1/6/1/0
ةماعلا تابلطتملا1 /1/6/1/0
دارفلأ ةرصتخم اريس وأ صاخلا بيردتلاو تاربخلا ةيفلخ نم لقحتلل اهريياعم ليدصتلا ةهجل نوكت نأ بجي
:ىندأ دحك يلي ام دكوت يتلا ليقدتلا ليرف
؛تامولعملا نمأب ةفرعملا )أ
.هقيقدت بولطملا طاشنلاب ةينقتلا ةفرعملا )ب
؛ةرادلإا مظنب ةفرعملا )ج
ليقدتلا ئدابمب ةفرعملا )د
ليقدتلائدابمنع تامولعملا نم اديزم ISO 19011.ةفصاوملا مدقت :ةظوحلم
ISMS تامولعملا نمأ ةرادإ مظن مييقتو ليلحتو تاسايقو ةبقارمب ةفرعملا )ه
ثيح ،)ب ءانثتساب ليقدتلا ليرف نم اءزج نولكشي نيذلا نيققدملا ةفاك ىلع )ه ىلإ )أ نم تابلطتملا هذه لبطنت
.ليرفلا ءاضعأ اهكراشتي
نمأ ةرادإ ماظن ىف نيمأتلا تاعقاو رهاوظ / تاملاع بتت نم هنكمي رادتقا ىلع ليقدتلا ليرف نوكي نأ بجي
.تامولعملا نمأ ةرادإ ماظن ىف ةبسانملا رصانعلا ىتح ايسكع ،ليمعلا ةأشنملل تامولعملا
لا اذهو( هلاعأ ةروكذملا رصانعلل /دونبلل يلمعلا ليبطتلاو ةبسانملا لمعلا ةربخب ليقدتلا ليرف تمتي نأ بجي
ليرفل رفوتت نأ بجي نكلو ،تامولعملا نمأ تلااجم يمج يف تاربخلا ىدم لماك ىلإ جاتحي لقدملا نأ ينعي
.)ISMS تامولعملا نمأ ةرادإ ماظنل ليقدتلا لاجم ةيطغتل ةربخلاو ريدقتلا نم يفكي ام لكك ةعجارملا
تامولعملا نمأ تاينقتو تاسراممو ئدابمو تاحلطصم 6/1/6/1/0
:ةيلاتلا فراعملا ليقدتلا ليرف دارفأ يمج ىدل نوكت نأ ىلع بجي ،امومع
3
ISO 2015 © ةظوفحم قوقحلا عيمج
---------------------- Page: 9 ----------------------
)ع( 5102/50112 يس يإ يأ/وزيأ
؛ةينيبلا اهتاقلاعو اهجردتو تامولعملا نمأ ةرادإ مظنب ةصاخلا ليثوتلا لكايه )أ
؛اهتاقيبطتو تامولعملا نمأ ةرادإ مظنب ةلصلا تاذ تاينقتلاو قرطلاو تاودلأا )ب
؛ تامولعملا نمأب ةصاخلا رطاخملا ةرادإو ريدقت )ج
؛ تامولعملا نمأ ةرادإ مظن ىلع ةقبطنملا تامولعملا )د
رابتعلااب ريدج وأ دراو تامولعملا نمأ ثيح ةيلاحلا تاينقتلا )ه
)دو )جو )أ رصانعلاب يفي نأ لقدم لك ىلع بجي
ةيرايعملا اهتادنتسمو تامولعملا نمأ ةرادإ مظن تافصاوم 3/1/6/1/0
:يلي امب تامولعملا نمأ ةرادإ مظن ليقدت يف نوكراشملا نوققدملا نوكي نأ بجي
50110 يس يا /وزيا ةفصاوملا يف ةدراولا تابلطتملا ةفاك )أ
:ةيلاتلا فراعملا ليقدتلا ليرف ءاضعأ لك ىدل نوكي نأ بجي،امومع
روظنم ةيرورض اضيأ اهنأ ددح ام اذإ( 50115 يس يا /وزيا ةفصاوملا يف ةدراولا طباوضلا ةفاك )ب
:يلاتلا وحنلا ىلع ةفنصم ،اهقيبطت ةيفيكو )ةيعاطق تافصاوم
تامولعملا نمأ تاسايس )0
تامولعملا نمأ ميظنت )5
ةيرشبلا دراوملا نمأ )3
لوصلأا ةرادإ )2
تايحلاصلا حنم انمضتم لوصولا طبض )2
ريفشتلا )2
يئيبلاو يداملا نملأا )0
تامولعملا تاينقت تامدخ اهيف امي تايلمعلا نمأ )8
تامولعملا لقن / ليوحتو تاكبشلا نمأ ةرادإ اهيف امب ،تلااصتلاا نمأ )2
اهتنايصو اهريوطتو مظنلا ءانتقا )01
يجراخلا ردصملا تاذ تامدخلا ةنمضتم نيدروملا تاقلاع )00
،تامولعملا نمأ تاعقاو ةرادإ )05
لامعلأا ةيرارمتسا ةرادإب صتخي اميف تامولعملا نمأ بناوج )03
تامولعملا نمأ تاعجارم انمضتم ،لاثتملاا )02
لامعلأا ةرادإ تاسرامم 4/1/6/1/0
تامولعملا نمأ ةرادإ ماظن ليقدت يف نيكراشملا نيققدملا ىدل نوكت نأ بجي
تامولعملا نمأ تاءارجإو ةعانصلا تامولعم نملأ ةديجلا تاسرامملا )أ
تامولعملا نملأ لامعلأا تابلطتمو ةسايس )ب
مئاتنلاو فادهلأاو تاسايسلا نيب ةينيبلا تاقلاعلاو تاسرامملاو ةماعلا تامولعملا نمأ ةرادإ ميهافم )ج
.ةقلاعلا تاذ تاحلطصملاو ةرادلإا تايلمع )د
تاذ معدلا تايلمع نم اهريغو ةيجراخلاو ةيلخادلا تلااصتلااو ةيرشبلا دراوملا ةراد اضيأ تايلمعلا هذه نمضتت :ةظوحلم
.ةقلاعلا
ليمعلا لامعأ عاطق 5/1/6/1/0
:ةيلاتلا فراعملا تامولعملا نمأ ةرادإ ماظن ليقدت يف نيكراشملا نيققدملا ىدل نوكت نأ بجي
ةلظم تحت وأ هنيعب يفارغج قاطن وأ تامولعملا نملأ هنيعب لاجم يف ةيميظنتلاو ةينوناقلا تابلطتملا )أ
.هنيعب يتاضق ماظن
2
© ISO 2015 - ةظوفحم قوقحلا عيمج
---------------------- Page: 10 ----------------------
)ع( 5102/50112يس يإ يأ / وزيأ
.ةقبسم ةينوناق ةيفلخ ةيميظنتلاو ةينوناقلا تابلطتملا ةفرعم يضتقت لا :ةظوحلم
.لامعلأا نم عاطقلا اذهب ةطبترملا تامولعملا نمأ رطاخم )ب
.ليمعلا لامعأ عاطقب ةقلاعلا تاذ تاينقتلاو تايلمعلاو تاحلطصملا )ج
.لامعلأا عاطقب ةقلاعلا تاذ تاسرامملا )د
.لمعلا ليرف نيب اكرتشم )أ رايعملا نوكي دق
ليمعلا ةأشنمو تايلمعو تاجتنم 2/1/6/1/0
:ةيلاتلا فراعملا تامولعملا نمأ ةرادإ ماظن ليقدت يف نيكراشملا نيققدملا ىدل نوكت نأ بجي ،امومع
نمأ ةرادإ ماظن ذيفنتو ريوطت ىلع اهتاقلاعو اهفئاظوو اهلكيهو اهتمكوحو اهمجحو ةأشنملا عون راثأ )أ
.جراخلا نم تاربخلاب ةناعتسلاا ةنمضتم ،ليدصتلا ةطشنأو تامولعملا
. ساولا روظنملا نم ةدقعملا تايلمعلا )ب
.ةمدخلا وأ متنملا ىلع ةقبطنملا ةيميظنتلاو ةينوناقلا تابلطتملا )ج
تامولعملا نمأ ةرادإ ماظن قيقدت قيرفر ةدايقل ةءافكلا تابلطتم 6/6/1/0
يف ىدبت نأ بجي يتلا،ةيلاتلا تابلطتملاب قرفلا ةداق يفبجي ،0/5/0/0 يف ةدراولا تابلطتملا ىلإ ةفاضلإاب
.مهتاداشرإبو مهفارشإ تحت ىرجت يتلا تاقيقدلا
.ليقدتلا ليرفو ،ليدصتلل ليقدتلا تايلمع ةرادإ تاراهمو فراعم )أ
.ةباتكو ةيهافش،ةيلاعفب لصاوتلا ىلع ةردقلا نايب )ب
بلطلا ةعجارم ءارجلإ ةءافكلا تابلطتم 3/6/1/0
ةيرايعملا اهتادنتسمو تامولعملا نمأ ةرادإ مظن تافصاوم 1/3/6/1/0
ليرفلا ءاضعأ رايتخلا ،ليقدتلا ليرف تاءافك ديدحتل تابلطلا ةعجارمب نيمئاقلا دارفلأا ىدل نوكي نأ بجي
:ةيلاتلا فراعملا ،ليقدتلا نمز ديدحتو
.ليدصتلا ةيلمع يف ةمدختسملاو ةقلاعلا تاذ ةيرايعملا اهتادنتسمو تامولعملا نمأ ةرادإ مظن تافصاوم )أ
ليمعلا لامعأ عاطق 6/3/6/1/0
ليرفلا ءاضعأ رايتخلا ،ليقدتلا ليرف تاءافك ديدحتل تابلطلا ةعجارمب نيمئاقلا دارفلأا ىدل نوكي نأ بجي
:ةيلاتلا فراعملا ،ليقدتلا نمز ديدحتو
.ليمعلا لامعأ عاطقب ةقلاعلا تاذ ةيلولأا رطاخملاو تاينقتلاو تايلمعلاو تاحلطصملا )أ
ليمعلا ةأشنمو تايلمعو تاجتنم 3/3/6/1/0
ليرفلا ءاضعأ رايتخلا ،ليقدتلا ليرف تاءافك ديدحتل تابلطلا ةعجارمب نيمئاقلا دارفلأا ىدل نوكي نأ بجي
:ةيلاتلا فراعملا ،ليقدتلا نمز ديدحتو
ريوطت ىلع اهتاقلاعو اهفئاظوو اهلكيهو اهتمكوحو اهمجحو ةأشنملا عونو هتايلمعو ليمعلا تاجتنم )أ
.جراخلا نم تاربخلاب ةناعتسلاا فئاظولا ةنمضتم،ليدصتلا ةطشنأو تامولعملا نمأ ةرادإ ماظن ذيفنتو
2
ISO 2015 © ةظوفحم قوقحلا عيمج
---------------------- Page: 11 ----------------------
)ع( 5102/50112 يس يإ يأ/وزيأ
قيدصتلا تارارق ةعانصو قيقدتلا ريراقت ةعجارمل ةءافكلا تابلطتم 4/6/1/0
ماع 1/ 4/6/1/0
مهنكمت يتلا فراعملا ،ليدصتلا تارارق ةعانصو ليقدتلا ريراقت ةعجارمب نيمئاقلا دارفلأا ىدل نوكي نأ بجي
ليبس ىلعو ،ليقدتلا ةيلاعف ىلع اهراثأو لاجملا ىلع تارييغتلا كلذكو ليدصتلا لاجم ةمئلام صيحمت نم
:ةطبترملا رطاخملاو تايدامتعلااو تاهجاولا زييمتل ةرمتسملا ةيحلاصلا صوصخلا
،ليدصتلا تارارق ةعانصو ليقدتلا ريراقت ةعجارمب نيمئاقلا دارفلأا ىدل نوكي نأ بجي ،كلذ ىلإ ةفاضإ
:يف فراعملا
امومع ةرادلإا مظن )أ
ليقدتلا تاءارجإو تايلمع )ب
ليقدتلا تاينقتو تاسراممو ئدابم )ج
تامولعملا نمأ تاينقتو تاسراممو ئدابمو تاحلطصم 6/4/6/1/0
:ةيلاتلا فراعملا ،ليدصتلا تارارق ةعانصو ليقدتلا ريراقت ةعجارمب نيمئاقلا دارفلأا ىدل نوكي نأ بجي
)دو )جو )أ 5/0/5/0/0 يف ةدراولا دونبلا )أ
.تامولعملا نمأب ةقلاعلا تاذ ةيميظنتلاو ةينوناقلا تابلطتملا )ب
ةيرايعملا اهتادنتسمو تامولعملا نمأ ةرادإ مظن تافصاوم 3/4/6/1/0
ليرفلا ءاضعأ رايتخلا،ليقدتلا ليرف تاءافك ديدحتل تابلطلا ةعجارمب نيمئاقلا دارفلأا ىدل نوكي نأ بجي
:ةيلاتلا فراعملا ،ليقدتلا نمز ديدحتو
.ليدصتلا ةيلمع يف ةمدختسملاو ةقلاعلا تاذ ةيرايعملا اهتادنتسمو تامولعملا نمأ ةرادإ مظن تافصاوم )أ
ليمعلا لامعأ عاطق 4/4/6/1/0
:ةيلاتلا فراعملا ،ليدصتلا تارارق ةعانصو ليقدتلا ريراقت ةعجارمب نيمئاقلا دارفلأا ىدل نوكي نأ بجي
.ليمعلا لامعأ عاطقب ةقلاعلا تاذ ةيلولأارطاخملاو تاينقتلاو تايلمعلاو تاحلطصملا )أ
ليمعلا ةأشنمو تايلمعو تاجتنم 5/4/6/1/0
:ةيلاتلا فراعملا ،ليدصتلا تارارق ةعانصو ليقدتلا ريراقت ةعجارمب نيمئاقلا دارفلأا ىدل نوكي نأ بجي
اهتاقلاعو اهفئاظوو اهلكيهو اهتمكوحو اهمجحو ةأشنملا عونو هتايلمعو ليمعلا تاجتنم)أ
تاداهشلا حنم ةطشنأ يفر نوكراشملا نولماعلا 6/0
لبطنت ،كلذ ىلإ ةفاضلإابو .5/0 دنبلا يف 0-00150 يس يإ يا /وزيا ةفصاوملا يف ةدراولا تابلطتملا لبطنت
ةيلاتلا تاهيجوتلاو تابلطتملا
قيقدتلا تاهج دارفرأ تاربخو فراعم نايب 1/6/0 م أ 1/6/0
:للاخ نمقيقدتلا تاهج دارفأ تاربخو فراعم تاداهشلا حنم تاهج نيبت نأ بجي
ISMSتامولعملا نمأ ةرادإ مظنب صتخي اميف اهب فرتعم تلاهؤم )أ
اقبطنم كلذ نوك لاح – لقدمك ليجستلا )ب
كلذ ىلع ةلادلا تادنتسملا ميدقتوISMS تامولعملا نمأ ةرادإ مظنيف ةيبيردتلا مماربلا يف كارتشلاا )ج
بلطلا دنع
2
© ISO 2015 - ةظوفحم قوقحلا عيمج
---------------------- Page: 12 ----------------------
)ع( 5102/50112يس يإ يأ / وزيأ
ةينهملا ةيمنتلل ةثدحم تلاجس ىلع ظافحلا )د
لاجملا فن يف رخآ لقدم لبق نمتامولعملا نمأ ةرادإ مظن ليقدت تايلمع دوهش )ه
نيققدملا رايتخا1/1/6/0
:مهنم لك نوكي نأ نيققدملا رايتخا ريياعم دكوي نأ بجي 0/5/0/0 ىلإ ةفاضلإاب
ةيعماجلا ةجردلا ئفاكي ىوتسم ىلع ينهم بيردت وأ ميلعت هيدل )أ
ايجولونكت لاجم يف لمعلا ناكم يف لماك تقوب لمعلا نم لقلأا ىلع تاونس برأ ةيلمع ةربخ )ب
؛تامولعملا نمأب للعتت ةفيظووأرود يف لقلأا ىلع ناتنس اهنم،تامولعملا
ةرادإو ISMS تامولعملا نمأ ةرادإ ماظن تاقيقدت اهلاجم ىطغي،حاجنب بيردتلا نم مايأ ةسمخ لامكإ )ج
؛ابسانم دعي امم ليقدتلا
هذه نوكت نأ بجي.لقدمك ءادلأا ةيلوؤسم لمحتل بق تامولعملا نمأ مييقت ةيلمع لماك يف ةبستكم ةربخ )د
نع هعومجم لقي لا اميف ،لقلأا ىلع ةداهش تاقيقدت ةعبرأ يف ةكراشملا للاخ نم ةبستكم ةربخلا
؛ليقدتلا ريراقتو ذيفنتلا مييقتو،رطاخملا ليلحتو لئاثولا ةعجارم نمضتت ،اموي نيرشع
.ةبسانم ةقلاع تاذ ةيلاح ةربخ )ه
ينهملا ريوطتلا للاخ نم ،ليقدتلاو تامولعملا نمأ لاجم يف مهتاراهمو مهفراعم ةثادح ىلع ظافحلا )و
.رمتسملا
)ـهو ،)بو ،)أ ريياعملل نوينفلاءاربخلا لثتمي نأ بجي
قيرفلا ةدايقل نيققدملا رابتخا 6/1/6/0
قيرفلل دئاقك ققدم رايتخا ريياعم نوكت نأ بجي،1/1/6/0 و6/1/6/0 يفر ةدراولا طورشلا ىلإ ةفراضلإاب
ققدملا نوكي نأ ةدكؤم
ISMS.تامولعملا نمأ ةرادلإ ماظن ليقدتل لقلأا ىلع ةلماك تايلمع ةثلا
...
SLOVENSKI STANDARD
SIST ISO/IEC 27006:2018
01-november-2018
1DGRPHãþD
SIST ISO/IEC 27006:2012
Informacijska tehnologija - Varnostne tehnike - Zahteve za organe, ki izvajajo
presojanje in certificiranje sistemov upravljanja informacijske varnosti
Information technology -- Security techniques -- Requirements for bodies providing audit
and certification of information security management systems
Technologies de l'information -- Techniques de sécurité -- Exigences pour les
organismes procédant à l'audit et à la certification des systèmes de management de la
sécurité de l'information
Ta slovenski standard je istoveten z: ISO/IEC 27006:2015
ICS:
03.100.70 Sistemi vodenja Management systems
03.120.20 Certificiranje proizvodov in Product and company
podjetij. Ugotavljanje certification. Conformity
skladnosti assessment
35.030 Informacijska varnost IT Security
SIST ISO/IEC 27006:2018 en,fr,de
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
---------------------- Page: 1 ----------------------
SIST ISO/IEC 27006:2018
---------------------- Page: 2 ----------------------
SIST ISO/IEC 27006:2018
INTERNATIONAL ISO/IEC
STANDARD 27006
Third edition
2015-10-01
Information technology — Security
techniques — Requirements
for bodies providing audit and
certification of information security
management systems
Technologies de l’information — Techniques de sécurité — Exigences
pour les organismes procédant à l’audit et à la certification des
systèmes de management de la sécurité de l’information
Reference number
ISO/IEC 27006:2015(E)
©
ISO/IEC 2015
---------------------- Page: 3 ----------------------
SIST ISO/IEC 27006:2018
ISO/IEC 27006:2015(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2015, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. +41 22 749 01 11
Fax +41 22 749 09 47
copyright@iso.org
www.iso.org
ii © ISO/IEC 2015 – All rights reserved
---------------------- Page: 4 ----------------------
SIST ISO/IEC 27006:2018
ISO/IEC 27006:2015(E)
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Principles . 1
5 General requirements . 2
5.1 Legal and contractual matters . 2
5.2 Management of impartiality . 2
5.2.1 IS 5.2 Conflicts of interest . 2
5.3 Liability and financing . 2
6 Structural requirements . 2
7 Resource requirements . 2
7.1 Competence of personnel . 2
7.1.1 IS 7.1.1 General considerations . 3
7.1.2 IS 7.1.2 Determination of Competence Criteria . 3
7.2 Personnel involved in the certification activities . 6
7.2.1 IS 7.2 Demonstration of auditor knowledge and experience . 6
7.3 Use of individual external auditors and external technical experts . 7
7.3.1 IS 7.3 Using external auditors or external technical experts as part of the
audit team . 7
7.4 Personnel records. 7
7.5 Outsourcing. 7
8 Information requirements . 8
8.1 Public information . 8
8.2 Certification documents . 8
8.2.1 IS 8.2 ISMS Certification documents . 8
8.3 Reference to certification and use of marks . 8
8.4 Confidentiality . 8
8.4.1 IS 8.4 Access to organizational records . 8
8.5 Information exchange between a certification body and its clients . 8
9 Process requirements . 8
9.1 Pre-certification activities . 8
9.1.1 Application . 8
9.1.2 Application review . 9
9.1.3 Audit programme . 9
9.1.4 Determining audit time .10
9.1.5 Multi-site sampling .10
9.1.6 Multiple management systems .11
9.2 Planning audits .11
9.2.1 Determining audit objectives, scope and criteria .11
9.2.2 Audit team selection and assignments .12
9.2.3 Audit plan .12
9.3 Initial certification .13
9.3.1 IS 9.3.1 Initial certification audit .13
9.4 Conducting audits .14
9.4.1 IS 9.4 General .14
9.4.2 IS 9.4 Specific elements of the ISMS audit .14
9.4.3 IS 9.4 Audit report .14
9.5 Certification decision .15
9.5.1 IS 9.5 Certification decision .15
© ISO/IEC 2015 – All rights reserved iii
---------------------- Page: 5 ----------------------
SIST ISO/IEC 27006:2018
ISO/IEC 27006:2015(E)
9.6 Maintaining certification .15
9.6.1 General.15
9.6.2 Surveillance activities .15
9.6.3 Re-certification .16
9.6.4 Special audits .17
9.6.5 Suspending, withdrawing or reducing the scope of certification .17
9.7 Appeals .17
9.8 Complaints .17
9.8.1 IS 9.8 Complaints .17
9.9 Client records .17
10 Management system requirements for certification bodies .17
10.1 Options .17
10.1.1 IS 10.1 ISMS implementation .17
10.2 Option A: General management system requirements .17
10.3 Option B: Management system requirements in accordance with ISO 9001.17
Annex A (informative) Knowledge and skills for ISMS auditing and certification .18
Annex B (normative) Audit time .20
Annex C (informative) Methods for audit time calculations .25
Annex D (informative) Guidance for review of implemented ISO/IEC 27001:2013,
Annex A controls .28
Bibliography .35
iv © ISO/IEC 2015 – All rights reserved
---------------------- Page: 6 ----------------------
SIST ISO/IEC 27006:2018
ISO/IEC 27006:2015(E)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for
the different types of document should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent
rights. Details of any patent rights identified during the development of the document will be in the
Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the meaning of ISO specific terms and expressions related to conformity
assessment, as well as information about ISO’s adherence to the WTO principles in the Technical
Barriers to Trade (TBT) see the following URL: Foreword - Supplementary information
The committee responsible for this document is ISO/IEC JTC 1, Information technology, SC 27, IT
Security techniques.
ISO/IEC 27006 was prepared by the Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, IT Security techniques.
This third edition cancels and replaces the second edition (ISO/IEC 27006:2011), which has been
technically revised.
© ISO/IEC 2015 – All rights reserved v
---------------------- Page: 7 ----------------------
SIST ISO/IEC 27006:2018
ISO/IEC 27006:2015(E)
Introduction
ISO/IEC 17021-1 sets out criteria for bodies operating audit and certification of management systems. If
such bodies are to be accredited as complying with ISO/IEC 17021-1 with the objective of auditing and
certifying information security management systems (ISMS) in accordance with ISO/IEC 27001:2013,
some additional requirements and guidance to ISO/IEC 17021-1 are necessary. These are provided by
this International Standard.
The text in this International Standard follows the structure of ISO/IEC 17021-1 and the additional
ISMS-specific requirements and guidance on the application of ISO/IEC 17021-1 for ISMS certification
are identified by the letters “IS”.
The term “shall” is used throughout this International Standard to indicate those provisions which,
reflecting the requirements of ISO/IEC 17021-1 and ISO/IEC 27001, are mandatory. The term “should” is
used to indicate recommendation.
The primary purpose of this International Standard is to enable accreditation bodies to more effectively
harmonize their application of the standards against which they are bound to assess certification bodies.
Throughout this International Standard, the terms “management system” and “system” are used
interchangeably. The definition of a management system can be found in ISO 9000:2005. The
management system as used in this International Standard is not to be confused with other types of
systems, such as IT systems.
vi © ISO/IEC 2015 – All rights reserved
---------------------- Page: 8 ----------------------
SIST ISO/IEC 27006:2018
INTERNATIONAL STANDARD ISO/IEC 27006:2015(E)
Information technology — Security techniques —
Requirements for bodies providing audit and certification
of information security management systems
1 Scope
This International Standard specifies requirements and provides guidance for bodies providing
audit and certification of an information security management system (ISMS), in addition to the
requirements contained within ISO/IEC 17021-1 and ISO/IEC 27001. It is primarily intended to support
the accreditation of certification bodies providing ISMS certification.
The requirements contained in this International Standard need to be demonstrated in terms of
competence and reliability by any body providing ISMS certification, and the guidance contained in
this International Standard provides additional interpretation of these requirements for any body
providing ISMS certification.
NOTE This International Standard can be used as a criteria document for accreditation, peer assessment or
other audit processes.
2 Normative references
The following documents, in whole or in part, are normatively referenced in this document and are
indispensable for its application. For dated references, only the edition cited applies. For undated
references, the latest edition of the referenced document (including any amendments) applies.
ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies providing audit and certification
of management systems — Part 1: Requirements
ISO/IEC 27000, Information technology — Security techniques — Information security management
systems — Overview and vocabulary
ISO/IEC 27001:2013, Information technology — Security techniques — Information security management
systems — Requirements
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/IEC 17021-1, ISO/IEC 27000
and the following apply.
3.1
certification documents
documents indicating that a client’s ISMS conforms to specified ISMS standards and any supplementary
documentation required under the system
4 Principles
The principles from ISO/IEC 17021-1, 4 apply.
© ISO/IEC 2015 – All rights reserved 1
---------------------- Page: 9 ----------------------
SIST ISO/IEC 27006:2018
ISO/IEC 27006:2015(E)
5 General requirements
5.1 Legal and contractual matters
The requirements of ISO/IEC 17021-1, 5.1 apply.
5.2 Management of impartiality
The requirements of ISO/IEC 17021-1, 5.2 apply. In addition, the following requirements and
guidance apply.
5.2.1 IS 5.2 Conflicts of interest
Certification bodies may carry out the following duties without them being considered as consultancy
or having a potential conflict of interest:
a) arranging and participating as a lecturer in training courses, provided that, where these
courses relate to information security management, related management systems or auditing,
certification bodies shall confine themselves to the provision of generic information and advice
which is publicly available, i.e. they shall not provide company-specific advice which contravenes
the requirements of b) below;
b) making available or publishing on request information describing the certification body’s
interpretation of the requirements of the certification audit standards (see 9.1.3.6);
c) activities prior to audit, solely aimed at determining readiness for certification audit; however, such
activities shall not result in the provision of recommendations or advice that would contravene this
clause and the certification body shall be able to confirm that such activities do not contravene
these requirements and that they are not used to justify a reduction in the eventual certification
audit duration;
d) performing second and third-party audits according to standards or regulations other than those
being part of the scope of accreditation;
e) adding value during certification audits and surveillance visits, e.g. by identifying opportunities for
improvement, as they become evident during the audit, without recommending specific solutions.
The certification body shall not provide internal information security reviews of the client’s ISMS
subject to certification. Furthermore, the certification body shall be independent from the body or
bodies (including any individuals) which provide the internal ISMS audit.
5.3 Liability and financing
The requirements of ISO/IEC 17021-1, 5.3 apply.
6 Structural requirements
The requirements of ISO/IEC 17021-1, 6 apply.
7 Resource requirements
7.1 Competence of personnel
The requirements of ISO/IEC 17021-1, 7.1 apply. In addition, the following requirements and
guidance apply.
2 © ISO/IEC 2015 – All rights reserved
---------------------- Page: 10 ----------------------
SIST ISO/IEC 27006:2018
ISO/IEC 27006:2015(E)
7.1.1 IS 7.1.1 General considerations
7.1.1.1 Generic competence requirements
The certification body shall ensure that it has knowledge of the technological, legal and regulatory
developments relevant to the ISMS of the client which it assesses.
The certification body shall define the competence requirements for each certification function as
referenced in Table A.1 of ISO/IEC 17021-1. The certification body shall take into account all the
requirements specified in ISO/IEC 17021-1 and 7.1.2 and 7.2.1 of this International Standard that are
relevant for the ISMS technical areas as determined by the certification body.
NOTE Annex A provides a summary of the competence requirements for personnel involved in specific
certification functions.
7.1.2 IS 7.1.2 Determination of Competence Criteria
7.1.2.1 Competence requirements for ISMS auditing
7.1.2.1.1 General requirements
The certification body shall have criteria for verifying the background experience, specific training or
briefing of audit team members that ensures at least:
a) knowledge of information security;
b) technical knowledge of the activity to be audited;
c) knowledge of management systems;
d) knowledge of the principles of auditing;
NOTE Further information on the principles of auditing can be found in ISO 19011.
e) knowledge of ISMS monitoring, measurement, analysis and evaluation.
These above requirements a) to e) apply to all auditors being part of the audit team, with the exception
of b), which can be shared among auditors being part of the audit team.
The audit team shall be competent to trace indications of information security incidents in the client’s
ISMS back to the appropriate elements of the ISMS.
The audit team shall have appropriate work experience of the items above and practical application
of these items (this does not mean that an auditor needs a complete range of experience of all areas of
information security, but the audit team as a whole shall have enough appreciation and experience to
cover the ISMS scope being audited).
7.1.2.1.2 Information security management terminology, principles, practices and techniques
Collectively, all members of the audit team shall have knowledge of:
a) ISMS specific documentation structures, hierarchy and interrelationships;
b) information security management related tools, methods, techniques and their application;
c) information security risk assessment and risk management;
d) processes applicable to ISMS;
e) the current technology where information security may be relevant or an issue.
© ISO/IEC 2015 – All rights reserved 3
---------------------- Page: 11 ----------------------
SIST ISO/IEC 27006:2018
ISO/IEC 27006:2015(E)
Every auditor shall fulfil a), c) and d).
7.1.2.1.3 Information security management system standards and normative documents
Auditors involved in ISMS auditing shall have knowledge of:
a) all requirements contained in ISO/IEC 27001.
Collectively, all members of the audit team shall have knowledge of:
b) all controls contained in ISO/IEC 27002 (if determined as necessary also from sector specific
standards) and their implementation, categorized as:
1) information security policies;
2) organization of information security;
3) human resource security;
4) asset management;
5) access control, including authorization;
6) cryptography;
7) physical and environmental security;
8) operations security, including IT-services;
9) communications security, including network security management and information transfer;
10) system acquisition, development and maintenance;
11) supplier relationships, including outsourced services;
12) information security incident management;
13) information security aspects of business continuity management, including redundancies;
14) compliance, including information security reviews.
7.1.2.1.4 Business management practices
Auditors involved in ISMS auditing shall have knowledge of:
a) industry information security good practices and information security procedures;
b) policies and business requirements for information security;
c) general business management concepts, practices and the inter-relationship between policy,
objectives and results;
d) management processes and related terminology.
NOTE These processes also include human resources management, internal and external communication
and other relevant support processes.
7.1.2.1.5 Client business sector
Auditors involved in ISMS auditing shall have knowledge of:
a) the legal and regulatory requirements in the particular information security field, geography and
jurisdiction(s);
4 © ISO/IEC 2015 – All rights reserved
---------------------- Page: 12 ----------------------
SIST ISO/IEC 27006:2018
ISO/IEC 27006:2015(E)
NOTE Knowledge of legal and regulatory requirements does not imply a profound legal background.
b) information security risks related to business sector;
c) generic terminology, processes and technologies related to the client business sector;
d) the relevant business sector practices.
The criteria a) may be shared amongst the audit team.
7.1.2.1.6 Client products, processes and organization
Collectively, auditors involved in ISMS auditing shall have knowledge of:
a) the impact of organization type, size, governance, structure, functions and relationships on
development and implementation of the ISMS and certification activities, including outsourcing;
b) compl
...
INTERNATIONAL ISO/IEC
STANDARD 27006
Third edition
2015-10-01
Information technology — Security
techniques — Requirements
for bodies providing audit and
certification of information security
management systems
Technologies de l’information — Techniques de sécurité — Exigences
pour les organismes procédant à l’audit et à la certification des
systèmes de management de la sécurité de l’information
Reference number
ISO/IEC 27006:2015(E)
©
ISO/IEC 2015
---------------------- Page: 1 ----------------------
ISO/IEC 27006:2015(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2015, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. +41 22 749 01 11
Fax +41 22 749 09 47
copyright@iso.org
www.iso.org
ii © ISO/IEC 2015 – All rights reserved
---------------------- Page: 2 ----------------------
ISO/IEC 27006:2015(E)
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Principles . 1
5 General requirements . 2
5.1 Legal and contractual matters . 2
5.2 Management of impartiality . 2
5.2.1 IS 5.2 Conflicts of interest . 2
5.3 Liability and financing . 2
6 Structural requirements . 2
7 Resource requirements . 2
7.1 Competence of personnel . 2
7.1.1 IS 7.1.1 General considerations . 3
7.1.2 IS 7.1.2 Determination of Competence Criteria . 3
7.2 Personnel involved in the certification activities . 6
7.2.1 IS 7.2 Demonstration of auditor knowledge and experience . 6
7.3 Use of individual external auditors and external technical experts . 7
7.3.1 IS 7.3 Using external auditors or external technical experts as part of the
audit team . 7
7.4 Personnel records. 7
7.5 Outsourcing. 7
8 Information requirements . 8
8.1 Public information . 8
8.2 Certification documents . 8
8.2.1 IS 8.2 ISMS Certification documents . 8
8.3 Reference to certification and use of marks . 8
8.4 Confidentiality . 8
8.4.1 IS 8.4 Access to organizational records . 8
8.5 Information exchange between a certification body and its clients . 8
9 Process requirements . 8
9.1 Pre-certification activities . 8
9.1.1 Application . 8
9.1.2 Application review . 9
9.1.3 Audit programme . 9
9.1.4 Determining audit time .10
9.1.5 Multi-site sampling .10
9.1.6 Multiple management systems .11
9.2 Planning audits .11
9.2.1 Determining audit objectives, scope and criteria .11
9.2.2 Audit team selection and assignments .12
9.2.3 Audit plan .12
9.3 Initial certification .13
9.3.1 IS 9.3.1 Initial certification audit .13
9.4 Conducting audits .14
9.4.1 IS 9.4 General .14
9.4.2 IS 9.4 Specific elements of the ISMS audit .14
9.4.3 IS 9.4 Audit report .14
9.5 Certification decision .15
9.5.1 IS 9.5 Certification decision .15
© ISO/IEC 2015 – All rights reserved iii
---------------------- Page: 3 ----------------------
ISO/IEC 27006:2015(E)
9.6 Maintaining certification .15
9.6.1 General.15
9.6.2 Surveillance activities .15
9.6.3 Re-certification .16
9.6.4 Special audits .17
9.6.5 Suspending, withdrawing or reducing the scope of certification .17
9.7 Appeals .17
9.8 Complaints .17
9.8.1 IS 9.8 Complaints .17
9.9 Client records .17
10 Management system requirements for certification bodies .17
10.1 Options .17
10.1.1 IS 10.1 ISMS implementation .17
10.2 Option A: General management system requirements .17
10.3 Option B: Management system requirements in accordance with ISO 9001.17
Annex A (informative) Knowledge and skills for ISMS auditing and certification .18
Annex B (normative) Audit time .20
Annex C (informative) Methods for audit time calculations .25
Annex D (informative) Guidance for review of implemented ISO/IEC 27001:2013,
Annex A controls .28
Bibliography .35
iv © ISO/IEC 2015 – All rights reserved
---------------------- Page: 4 ----------------------
ISO/IEC 27006:2015(E)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for
the different types of document should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent
rights. Details of any patent rights identified during the development of the document will be in the
Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the meaning of ISO specific terms and expressions related to conformity
assessment, as well as information about ISO’s adherence to the WTO principles in the Technical
Barriers to Trade (TBT) see the following URL: Foreword - Supplementary information
The committee responsible for this document is ISO/IEC JTC 1, Information technology, SC 27, IT
Security techniques.
ISO/IEC 27006 was prepared by the Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, IT Security techniques.
This third edition cancels and replaces the second edition (ISO/IEC 27006:2011), which has been
technically revised.
© ISO/IEC 2015 – All rights reserved v
---------------------- Page: 5 ----------------------
ISO/IEC 27006:2015(E)
Introduction
ISO/IEC 17021-1 sets out criteria for bodies operating audit and certification of management systems. If
such bodies are to be accredited as complying with ISO/IEC 17021-1 with the objective of auditing and
certifying information security management systems (ISMS) in accordance with ISO/IEC 27001:2013,
some additional requirements and guidance to ISO/IEC 17021-1 are necessary. These are provided by
this International Standard.
The text in this International Standard follows the structure of ISO/IEC 17021-1 and the additional
ISMS-specific requirements and guidance on the application of ISO/IEC 17021-1 for ISMS certification
are identified by the letters “IS”.
The term “shall” is used throughout this International Standard to indicate those provisions which,
reflecting the requirements of ISO/IEC 17021-1 and ISO/IEC 27001, are mandatory. The term “should” is
used to indicate recommendation.
The primary purpose of this International Standard is to enable accreditation bodies to more effectively
harmonize their application of the standards against which they are bound to assess certification bodies.
Throughout this International Standard, the terms “management system” and “system” are used
interchangeably. The definition of a management system can be found in ISO 9000:2005. The
management system as used in this International Standard is not to be confused with other types of
systems, such as IT systems.
vi © ISO/IEC 2015 – All rights reserved
---------------------- Page: 6 ----------------------
INTERNATIONAL STANDARD ISO/IEC 27006:2015(E)
Information technology — Security techniques —
Requirements for bodies providing audit and certification
of information security management systems
1 Scope
This International Standard specifies requirements and provides guidance for bodies providing
audit and certification of an information security management system (ISMS), in addition to the
requirements contained within ISO/IEC 17021-1 and ISO/IEC 27001. It is primarily intended to support
the accreditation of certification bodies providing ISMS certification.
The requirements contained in this International Standard need to be demonstrated in terms of
competence and reliability by any body providing ISMS certification, and the guidance contained in
this International Standard provides additional interpretation of these requirements for any body
providing ISMS certification.
NOTE This International Standard can be used as a criteria document for accreditation, peer assessment or
other audit processes.
2 Normative references
The following documents, in whole or in part, are normatively referenced in this document and are
indispensable for its application. For dated references, only the edition cited applies. For undated
references, the latest edition of the referenced document (including any amendments) applies.
ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies providing audit and certification
of management systems — Part 1: Requirements
ISO/IEC 27000, Information technology — Security techniques — Information security management
systems — Overview and vocabulary
ISO/IEC 27001:2013, Information technology — Security techniques — Information security management
systems — Requirements
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/IEC 17021-1, ISO/IEC 27000
and the following apply.
3.1
certification documents
documents indicating that a client’s ISMS conforms to specified ISMS standards and any supplementary
documentation required under the system
4 Principles
The principles from ISO/IEC 17021-1, 4 apply.
© ISO/IEC 2015 – All rights reserved 1
---------------------- Page: 7 ----------------------
ISO/IEC 27006:2015(E)
5 General requirements
5.1 Legal and contractual matters
The requirements of ISO/IEC 17021-1, 5.1 apply.
5.2 Management of impartiality
The requirements of ISO/IEC 17021-1, 5.2 apply. In addition, the following requirements and
guidance apply.
5.2.1 IS 5.2 Conflicts of interest
Certification bodies may carry out the following duties without them being considered as consultancy
or having a potential conflict of interest:
a) arranging and participating as a lecturer in training courses, provided that, where these
courses relate to information security management, related management systems or auditing,
certification bodies shall confine themselves to the provision of generic information and advice
which is publicly available, i.e. they shall not provide company-specific advice which contravenes
the requirements of b) below;
b) making available or publishing on request information describing the certification body’s
interpretation of the requirements of the certification audit standards (see 9.1.3.6);
c) activities prior to audit, solely aimed at determining readiness for certification audit; however, such
activities shall not result in the provision of recommendations or advice that would contravene this
clause and the certification body shall be able to confirm that such activities do not contravene
these requirements and that they are not used to justify a reduction in the eventual certification
audit duration;
d) performing second and third-party audits according to standards or regulations other than those
being part of the scope of accreditation;
e) adding value during certification audits and surveillance visits, e.g. by identifying opportunities for
improvement, as they become evident during the audit, without recommending specific solutions.
The certification body shall not provide internal information security reviews of the client’s ISMS
subject to certification. Furthermore, the certification body shall be independent from the body or
bodies (including any individuals) which provide the internal ISMS audit.
5.3 Liability and financing
The requirements of ISO/IEC 17021-1, 5.3 apply.
6 Structural requirements
The requirements of ISO/IEC 17021-1, 6 apply.
7 Resource requirements
7.1 Competence of personnel
The requirements of ISO/IEC 17021-1, 7.1 apply. In addition, the following requirements and
guidance apply.
2 © ISO/IEC 2015 – All rights reserved
---------------------- Page: 8 ----------------------
ISO/IEC 27006:2015(E)
7.1.1 IS 7.1.1 General considerations
7.1.1.1 Generic competence requirements
The certification body shall ensure that it has knowledge of the technological, legal and regulatory
developments relevant to the ISMS of the client which it assesses.
The certification body shall define the competence requirements for each certification function as
referenced in Table A.1 of ISO/IEC 17021-1. The certification body shall take into account all the
requirements specified in ISO/IEC 17021-1 and 7.1.2 and 7.2.1 of this International Standard that are
relevant for the ISMS technical areas as determined by the certification body.
NOTE Annex A provides a summary of the competence requirements for personnel involved in specific
certification functions.
7.1.2 IS 7.1.2 Determination of Competence Criteria
7.1.2.1 Competence requirements for ISMS auditing
7.1.2.1.1 General requirements
The certification body shall have criteria for verifying the background experience, specific training or
briefing of audit team members that ensures at least:
a) knowledge of information security;
b) technical knowledge of the activity to be audited;
c) knowledge of management systems;
d) knowledge of the principles of auditing;
NOTE Further information on the principles of auditing can be found in ISO 19011.
e) knowledge of ISMS monitoring, measurement, analysis and evaluation.
These above requirements a) to e) apply to all auditors being part of the audit team, with the exception
of b), which can be shared among auditors being part of the audit team.
The audit team shall be competent to trace indications of information security incidents in the client’s
ISMS back to the appropriate elements of the ISMS.
The audit team shall have appropriate work experience of the items above and practical application
of these items (this does not mean that an auditor needs a complete range of experience of all areas of
information security, but the audit team as a whole shall have enough appreciation and experience to
cover the ISMS scope being audited).
7.1.2.1.2 Information security management terminology, principles, practices and techniques
Collectively, all members of the audit team shall have knowledge of:
a) ISMS specific documentation structures, hierarchy and interrelationships;
b) information security management related tools, methods, techniques and their application;
c) information security risk assessment and risk management;
d) processes applicable to ISMS;
e) the current technology where information security may be relevant or an issue.
© ISO/IEC 2015 – All rights reserved 3
---------------------- Page: 9 ----------------------
ISO/IEC 27006:2015(E)
Every auditor shall fulfil a), c) and d).
7.1.2.1.3 Information security management system standards and normative documents
Auditors involved in ISMS auditing shall have knowledge of:
a) all requirements contained in ISO/IEC 27001.
Collectively, all members of the audit team shall have knowledge of:
b) all controls contained in ISO/IEC 27002 (if determined as necessary also from sector specific
standards) and their implementation, categorized as:
1) information security policies;
2) organization of information security;
3) human resource security;
4) asset management;
5) access control, including authorization;
6) cryptography;
7) physical and environmental security;
8) operations security, including IT-services;
9) communications security, including network security management and information transfer;
10) system acquisition, development and maintenance;
11) supplier relationships, including outsourced services;
12) information security incident management;
13) information security aspects of business continuity management, including redundancies;
14) compliance, including information security reviews.
7.1.2.1.4 Business management practices
Auditors involved in ISMS auditing shall have knowledge of:
a) industry information security good practices and information security procedures;
b) policies and business requirements for information security;
c) general business management concepts, practices and the inter-relationship between policy,
objectives and results;
d) management processes and related terminology.
NOTE These processes also include human resources management, internal and external communication
and other relevant support processes.
7.1.2.1.5 Client business sector
Auditors involved in ISMS auditing shall have knowledge of:
a) the legal and regulatory requirements in the particular information security field, geography and
jurisdiction(s);
4 © ISO/IEC 2015 – All rights reserved
---------------------- Page: 10 ----------------------
ISO/IEC 27006:2015(E)
NOTE Knowledge of legal and regulatory requirements does not imply a profound legal background.
b) information security risks related to business sector;
c) generic terminology, processes and technologies related to the client business sector;
d) the relevant business sector practices.
The criteria a) may be shared amongst the audit team.
7.1.2.1.6 Client products, processes and organization
Collectively, auditors involved in ISMS auditing shall have knowledge of:
a) the impact of organization type, size, governance, structure, functions and relationships on
development and implementation of the ISMS and certification activities, including outsourcing;
b) complex operations in a broad perspective;
c) legal and regulatory requirements applicable to the product or service.
7.1.2.2 Competence requirements for leading the ISMS audit team
In addition to the requirements in 7.1.2.1, audit team leaders shall fulfil the following requirements,
which shall be demonstrated in audits under guidance and supervision:
a) knowledge and skills to manage the certification audit process and the audit team;
b) demonstration of the capability to communicate effectively, both orally and in writing.
7.1.2.3 Competence requirements for conducting the application review
7.1.2.3.1 Information security management system standards and normative documents
Personnel conducting the application review to determine audit team competence required, to select
the audit team members and to determine the audit time shall have knowledge of:
a) relevant ISMS standards and other normative documents used in the certification process.
7.1.2.3.2 Client business sector
Personnel conducting the application review to determine the audit team competence required, to
select the audit team members and to determine the audit time shall have knowledge of:
a) generic terminology, processes, technologies and risks related to the client business sector.
7.1.2.3.3 Client products, processes and organization
Personnel conducting the application review to determine audit team competence required, to select
the audit team membe
...
NORME ISO/IEC
INTERNATIONALE 27006
Troisième édition
2015-10
Technologies de l'information —
Techniques de sécurité — Exigences
pour les organismes procédant
à l'audit et à la certification des
systèmes de management de la
sécurité de l'information
Information technology — Security techniques — Requirements
for bodies providing audit and certification of information security
management systems
Numéro de référence
ISO/IEC 27006:2015(F)
©
ISO/IEC 2015
---------------------- Page: 1 ----------------------
ISO/IEC 27006:2015(F)
DOCUMENT PROTÉGÉ PAR COPYRIGHT
© ISO/IEC 2015
Tous droits réservés. Sauf prescription différente ou nécessité dans le contexte de sa mise en œuvre, aucune partie de cette
publication ne peut être reproduite ni utilisée sous quelque forme que ce soit et par aucun procédé, électronique ou mécanique,
y compris la photocopie, ou la diffusion sur l’internet ou sur un intranet, sans autorisation écrite préalable. Une autorisation peut
être demandée à l’ISO à l’adresse ci-après ou au comité membre de l’ISO dans le pays du demandeur.
ISO copyright office
Case postale 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Genève
Tél.: +41 22 749 01 11
E-mail: copyright@iso.org
Web: www.iso.org
Publié en Suisse
ii © ISO/IEC 2015 – Tous droits réservés
---------------------- Page: 2 ----------------------
ISO/IEC 27006:2015(F)
Sommaire Page
Avant-propos .v
Introduction .vi
1 Domaine d'application . 1
2 Références normatives . 1
3 Termes et définitions . 1
4 Principes . 1
5 Exigences générales . 2
5.1 Domaine juridique et contractuel . 2
5.2 Gestion de l’impartialité . 2
5.2.1 SI 5.2 Conflits d'intérêts . . 2
5.3 Responsabilité et situation financière . 2
6 Exigences structurelles . 2
7 Exigences relatives aux ressources . 2
7.1 Compétence du personnel . 2
7.1.1 SI 7.1.1 Considérations générales . 3
7.1.2 SI 7.1.2 Détermination des critères de compétence . 3
7.2 Personnel intervenant dans les activités de certification . 7
7.2.1 SI 7.2 Démonstration des connaissances et de l'expérience des auditeurs . 7
7.3 Intervention d’auditeurs et d’experts techniques externes individuels . 8
7.3.1 SI 7.3 Intervention d'auditeurs externes ou d'experts techniques externes
au sein de l'équipe d'audit . 8
7.4 Enregistrements relatifs au personnel . 8
7.5 Externalisation . 8
8 Exigences relatives aux informations . 8
8.1 Informations publiques . 8
8.2 Documents de certification . 8
8.2.1 SI 8.2 Documents de certification SMSI . 8
8.3 Référence à la certification et utilisation des marques . 9
8.4 Confidentialité . 9
8.4.1 SI 8.4 Accès aux enregistrements de l'organisation . 9
8.5 Échange d’informations entre l’organisme de certification et ses clients . 9
9 Exigences relatives aux processus . 9
9.1 Activités préalables à la certification . 9
9.1.1 Demande de certification . 9
9.1.2 Revue de la demande . 9
9.1.3 Programme d’audit . 9
9.1.4 Détermination du temps d'audit .10
9.1.5 Échantillonnage multisite .11
9.1.6 Systèmes de management multiples .12
9.2 Planification des audits.12
9.2.1 Détermination des objectifs, du domaine d’application et des critères de
l’audit .12
9.2.2 Constitution de l’équipe d’audit et affectation des missions .12
9.2.3 Plan d’audit .13
9.3 Certification initiale .14
9.3.1 SI 9.3.1 Audit de certification initiale .14
9.4 Réalisation des audits .15
9.4.1 SI 9.4 Généralités .15
9.4.2 SI 9.4 Éléments spécifiques de l'audit de SMSI .15
9.4.3 SI 9.4 Rapport d'audit .15
9.5 Décision de certification .16
© ISO/IEC 2015 – Tous droits réservés iii
---------------------- Page: 3 ----------------------
ISO/IEC 27006:2015(F)
9.5.1 SI 9.5 Décision de certification .16
9.6 Maintien de la certification.16
9.6.1 Généralités .16
9.6.2 Activités de surveillance .16
9.6.3 Recertification .17
9.6.4 Audits particuliers .18
9.6.5 Suspension, retrait ou réduction du domaine d’application de la certification .18
9.7 Appels .18
9.8 Plaintes .18
9.8.1 SI 9.8 Plaintes.18
9.9 Enregistrements relatifs au client .18
10 Exigences relatives au système de management des organismes de certification .18
10.1 Options .18
10.1.1 SI 10.1 Mise en œuvre du SMSI .18
10.2 Option A : Exigences générales relatives au système de management .18
10.3 Option B : Exigences relatives au système de management conformément à l’ISO 9001 .18
Annexe A (informative) Connaissances et savoir-faire requis pour l'audit et la certification
d'un SMSI .19
Annexe B (normative) Temps d'audit .21
Annexe C (informative) Méthodes de calcul du temps d'audit .26
Annexe D (informative) Recommandations pour la revue des mesures mises en œuvre de
l'Annexe A de l'ISO/IEC 27001:2013.30
Bibliographie .39
iv © ISO/IEC 2015 – Tous droits réservés
---------------------- Page: 4 ----------------------
ISO/IEC 27006:2015(F)
Avant-propos
L'ISO (Organisation internationale de normalisation) et l'IEC (Commission électrotechnique
internationale) forment le système spécialisé de la normalisation mondiale. Les organismes
nationaux membres de l'ISO ou de l'IEC participent au développement de Normes internationales
par l'intermédiaire des comités techniques créés par l'organisation concernée afin de s'occuper des
domaines particuliers de l'activité technique. Les comités techniques de l'ISO et de l'IEC collaborent
dans des domaines d'intérêt commun. D'autres organisations internationales, gouvernementales et non
gouvernementales, en liaison avec l'ISO et l'IEC participent également aux travaux. Dans le domaine des
technologies de l'information, l'ISO et l'IEC ont créé un comité technique mixte, l'ISO/IEC JTC 1.
Les procédures utilisées pour élaborer le présent document et celles destinées à sa mise à jour sont
décrites dans les Directives ISO/IEC, Partie 1. Il convient, en particulier, de prendre note des différents
critères d'approbation requis pour les différents types de document. Le présent document a été rédigé
conformément aux règles de rédaction données dans les Directives ISO/IEC, Partie 2 (voir www .iso
.org/ directives).
L'attention est attirée sur le fait que certains des éléments du présent document peuvent faire l'objet
de droits de propriété intellectuelle ou de droits analogues. L'ISO et l'IEC ne sauraient être tenues pour
responsables de ne pas avoir identifié de tels droits de propriété et averti de leur existence. Les détails
concernant les références aux droits de propriété intellectuelle ou autres droits analogues identifiés
lors de l'élaboration du document sont indiqués dans l'Introduction et/ou dans la liste des déclarations
de brevets reçues par l'ISO (voir www .iso .org/ brevets).
Les appellations commerciales éventuellement mentionnées dans le présent document sont données
pour information, par souci de commodité, à l'intention des utilisateurs et ne sauraient constituer un
engagement.
Pour une explication de la signification des termes et expressions spécifiques de l'ISO liés à l'évaluation
de la conformité, ou pour toute information au sujet de l'adhésion de l'ISO aux principes de l'Organisation
mondiale du commerce (OMC) concernant les obstacles techniques au commerce (OTC), voir le lien
suivant : Avant-propos — Informations supplémentaires.
Le comité chargé de l'élaboration du présent document est l'ISO/IEC JTC 1, Technologies de l'information,
sous-comité SC 27, Sécurité de l’information, cybersécurité et protection de la vie privée.
L'ISO/IEC 27006 a été élaborée par le comité technique mixte ISO/IEC TC JTC 1, Technologies de
l'information, sous-comité SC 27, Sécurité de l’information, cybersécurité et protection de la vie privée.
La présente troisième édition annule et remplace la deuxième édition (ISO/IEC 27006:2011) qui a fait
l'objet d'une révision technique.
© ISO/IEC 2015 – Tous droits réservés v
---------------------- Page: 5 ----------------------
ISO/IEC 27006:2015(F)
Introduction
L'ISO/IEC 17021-1 énonce les critères applicables aux organismes procédant à l'audit et à la certification
des systèmes de management. Si lesdits organismes sont à accréditer comme étant conformes
à l'ISO/IEC 17021-1 dans le but de procéder à l'audit et de certifier les systèmes de management de
la sécurité de l'information (SMSI) conformément à l'ISO/IEC 27001:2013, certaines exigences et
recommandations complémentaires de l'ISO/IEC 17021-1 sont nécessaires. Celles-ci sont fournies par la
présente Norme internationale.
Le texte de la présente Norme internationale suit la structure de l'ISO/IEC 17021-1, et les exigences
et recommandations spécifiques aux SMSI relatives à l'application de l'ISO/IEC 17021-1 pour la
certification de SMSI sont identifiées par les lettres « SI ».
Le terme « shall » (doit) est utilisé dans la version en langue anglaise de la présente Norme
internationale pour indiquer les dispositions qui, conformément aux exigences de l'ISO/IEC 17021-1 et
de l'ISO/IEC 27001, revêtent un caractère obligatoire. Le terme « should » (il convient de/que) est utilisé
pour indiquer une recommandation.
L'objectif principal de la présente Norme internationale est de permettre aux organismes d'accréditation
d'harmoniser plus efficacement l’application des normes sur la base desquelles ils sont tenus d'évaluer
les organismes de certification.
Dans l'ensemble de la présente Norme internationale, les termes « système de management » et
« système » sont utilisés de façon interchangeable. La définition d'un système de management
est disponible dans l'ISO 9000:2005. Le système de management utilisé dans la présente Norme
internationale n'est pas à confondre avec d'autres types de systèmes, tels que les systèmes d’information.
vi © ISO/IEC 2015 – Tous droits réservés
---------------------- Page: 6 ----------------------
NORME INTERNATIONALE ISO/IEC 27006:2015(F)
Technologies de l'information — Techniques de sécurité
— Exigences pour les organismes procédant à l'audit et à
la certification des systèmes de management de la sécurité
de l'information
1 Domaine d'application
La présente Norme internationale spécifie les exigences et fournit des recommandations pour les
organismes procédant à l'audit et à la certification d'un système de management de la sécurité de
l'information (SMSI), en plus des exigences contenues dans l'ISO/IEC 17021-1 et l'ISO/IEC 27001. Elle
a pour principal objet de soutenir l'accréditation des organismes de certification qui procèdent à la
certification de SMSI.
Il est nécessaire que tout organisme qui procède à la certification de SMSI démontre qu'il respecte les
exigences stipulées dans la présente Norme internationale en termes de compétences et de fiabilité, et
les recommandations contenues dans la présente Norme internationale fournissent une interprétation
supplémentaire de ces exigences pour tout organisme procédant à la certification de SMSI.
NOTE La présente Norme internationale peut être utilisée comme référentiel pour l'accréditation,
l'évaluation par des pairs ou d'autres processus d'audit.
2 Références normatives
Les documents ci-après, dans leur intégralité ou non, sont des références normatives indispensables à
l'application du présent document. Pour les références datées, seule l'édition citée s'applique. Pour les
références non datées, la dernière édition du document de référence s'applique (y compris les éventuels
amendements).
ISO/IEC 17021-1:2015, Évaluation de la conformité — Exigences pour les organismes procédant à l'audit et
à la certification des systèmes de management — Partie 1: Exigences
ISO/IEC 27000, Technologies de l'information — Techniques de sécurité — Systèmes de management de la
sécurité de l'information — Vue d'ensemble et vocabulaire
ISO/IEC 27001:2013, Technologies de l'information — Techniques de sécurité — Systèmes de management
de la sécurité de l'information — Exigences
3 Termes et définitions
Pour les besoins du présent document, les termes et définitions donnés dans l'ISO/IEC 17021-1,
l'ISO/IEC 27000 et les suivants s’appliquent.
3.1
documents de certification
documents indiquant que le SMSI d'un client est conforme à des normes de SMSI spécifiées et à toute
documentation supplémentaire requise en vertu du système
4 Principes
Les principes de l'ISO/IEC 17021-1, 4 s'appliquent.
© ISO/IEC 2015 – Tous droits réservés 1
---------------------- Page: 7 ----------------------
ISO/IEC 27006:2015(F)
5 Exigences générales
5.1 Domaine juridique et contractuel
Les exigences de l'ISO/IEC 17021-1, 5.1 s'appliquent.
5.2 Gestion de l’impartialité
Les exigences de l'ISO/IEC 17021-1, 5.2 s'appliquent. De plus, les exigences et recommandations
suivantes s'appliquent.
5.2.1 SI 5.2 Conflits d'intérêts
Les organismes de certification peuvent effectuer les tâches suivantes sans que celles-ci soient
considérées comme des activités de conseil ou qu’elles génèrent un potentiel conflit d'intérêts :
a) organiser et participer en tant que formateur à des formations, à condition que, lorsque ces cours se
rapportent au management de la sécurité de l'information, aux systèmes de management associés
ou à l'audit, les organismes de certification doivent se limiter à la fourniture d'informations et de
conseils génériques qui sont publiquement disponibles, c'est-à-dire qu'ils ne doivent pas fournir de
conseils spécifiques à une entreprise qui enfreigne les exigences du point b) ci-dessous ;
b) mettre à disposition ou publier sur demande des informations décrivant l'interprétation que fait
l'organisme de certification des exigences des normes d'audit de certification (voir 9.1.3.6) ;
c) activités préalables à l'audit uniquement destinées à déterminer l'état de préparation en vue
de l'audit de certification ; toutefois, de ces activités ne doit pas résulter la production de
recommandations ou de conseils qui contreviendraient au présent paragraphe et l'organisme
de certification doit être en mesure de confirmer que ces activités ne contreviennent pas à ces
exigences et qu'elles ne sont pas utilisées pour justifier une réduction de la durée finale de l'audit de
certification ;
d) réaliser des audits seconde partie ou tierce partie conformément à des normes ou règlementations
autres que celles relevant du domaine d’application de l'accréditation ;
e) apporter de la plus-value pendant les audits de certification et les visites de surveillance, par
exemple en identifiant des opportunités d'amélioration, lorsqu'elles apparaissent pendant l'audit,
sans recommander de solutions spécifiques.
L'organisme de certification ne doit pas fournir de revues internes de la sécurité de l'information du
SMSI du client soumis à certification. De plus, l'organisme de certification doit être indépendant du ou
des organismes (y compris de toutes personnes) qui effectuent l'audit interne du SMSI.
5.3 Responsabilité et situation financière
Les exigences de l'ISO/IEC 17021-1, 5.3 s'appliquent.
6 Exigences structurelles
Les exigences de l'ISO/IEC 17021-1, 6 s'appliquent.
7 Exigences relatives aux ressources
7.1 Compétence du personnel
Les exigences de l'ISO/IEC 17021-1, 7.1 s'appliquent. De plus, les exigences et recommandations
suivantes s'appliquent.
2 © ISO/IEC 2015 – Tous droits réservés
---------------------- Page: 8 ----------------------
ISO/IEC 27006:2015(F)
7.1.1 SI 7.1.1 Considérations générales
7.1.1.1 Exigences génériques en matière de compétence
L'organisme de certification doit s'assurer d'avoir la connaissance des développements technologiques,
juridiques et règlementaires pertinentes pour le SMSI du client qu'il évalue.
L'organisme de certification doit définir les exigences en matière de compétence pour chaque fonction
de certification référencée au Tableau A.1 de l'ISO/IEC 17021-1. L'organisme de certification doit prendre
en compte l'ensemble des exigences spécifiées dans l'ISO/IEC 17021-1 et les paragraphes 7.1.2 et 7.2.1
de la présente Norme internationale qui sont pertinentes pour les secteurs techniques du SMSI tel que
déterminé par l'organisme de certification.
NOTE L'Annexe A fournit une synthèse des exigences en matière de compétence applicables au personnel
impliqué dans certaines fonctions de certification spécifiques.
7.1.2 SI 7.1.2 Détermination des critères de compétence
7.1.2.1 Exigences de compétence pour l'audit de SMSI
7.1.2.1.1 Exigences générales
L'organisme de certification doit avoir mis en place des critères permettant de vérifier l'expérience
professionnelle, la formation spécifique ou l'information des membres de l'équipe d'audit qui
garantissent au moins :
a) la connaissance de la sécurité de l'information ;
b) les connaissances techniques de l'activité à auditer ;
c) la connaissance des systèmes de management ;
d) la connaissance des principes de l'audit ;
NOTE Des informations supplémentaires sur les principes de l'audit sont disponibles dans l'ISO 19011.
e) connaissance de la surveillance, de la mesure, de l'analyse et de l'évaluation des SMSI.
Les exigences a) à e) ci-dessus s'appliquent à tous les auditeurs qui font partie de l'équipe d'audit, à
l'exception de b), qui peut être partagée entre les auditeurs qui font partie de l'équipe d'audit.
L'équipe d'audit doit avoir les compétences lui permettant d'établir le lien entre les traces d'incidents de
sécurité de l'information dans le SMSI du client et les éléments appropriés du SMSI.
L'équipe d'audit doit avoir une expérience professionnelle appropriée sur les sujets ci-dessus et une
application pratique de ces sujets (cela ne signifie pas qu'il est nécessaire qu'un auditeur possède un
éventail complet d'expériences dans tous les domaines de la sécurité de l'information, mais l'équipe
d'audit dans son ensemble doit posséder une compréhension et une expérience suffisantes pour couvrir
le domaine d’application du SMSI soumis à l'audit).
7.1.2.1.2 Terminologie, principes, pratiques et techniques du management de la sécurité de
l'information
Collectivement, les membres de l'équipe d'audit doivent avoir la connaissance :
a) des structures, de la hiérarchie de la documentation spécifique aux SMSI et des relations entre les
documents ;
b) des outils, des méthodes et des techniques de management de la sécurité de l'information, et leur
application ;
© ISO/IEC 2015 – Tous droits réservés 3
---------------------- Page: 9 ----------------------
ISO/IEC 27006:2015(F)
c) de l’appréciation du risque et management du risque de la sécurité de l'information ;
d) des processus applicables aux SMSI ;
e) de la technologie existante quand la sécurité de l'information présente un intérêt ou pose un
problème
Chaque auditeur doit satisfaire aux points a), c) et d).
7.1.2.1.3 Normes et documents normatifs relatifs aux systèmes de management de la sécurité
de l'information
Les auditeurs procédant à l'audit de SMSI doivent avoir connaissance :
a) de toutes les exigences contenues dans l'ISO/IEC 27001.
Collectivement, les membres de l'équipe d'audit doivent avoir connaissance :
b) de toutes les mesures contenues dans l'ISO/IEC 27002 (si cela est aussi identifié comme nécessaire
par les normes spécifiques au secteur) et leur mise en œuvre, réparties dans les catégories
suivantes :
1) politiques de sécurité de l'information ;
2) organisation de la sécurité de l'information ;
3) sécurité des ressources humaines ;
4) gestion des actifs ;
5) contrôle d’accès, y compris l'autorisation ;
6) cryptographie ;
7) sécurité physique et environnementale ;
8) sécurité liée à l'exploitation, y compris les services d’information ;
9) sécurité des communications, y compris la gestion de la sécurité des réseaux et le transfert de
l'information ;
10) acquisition, développement et maintenance des systèmes d'information ;
11) relations avec les fournisseurs, y compris les services externalisés ;
12) gestion des incidents liés à la sécurité de l'information ;
13) aspects de la sécurité de l'information dans la gestion de la continuité de l'activité, y compris
les redondances ;
14) conformité, y compris les revues de la sécurité de l'information.
7.1.2.1.4 Pratiques managériales des entreprises
Les auditeurs procédant à l'audit de SMSI doivent avoir la connaissance :
a) des bonnes pratiques de sécurité de l'information de l’industrie et les procédures de sécurité de
l'information ;
b) des politiques et exigences métier en matière de sécurité de l'information ;
c) des pratiques et concepts généraux en matière de gestion d'activité, et de la relation entre politique,
objectifs et résultats ;
4 © ISO/IEC 2015 – Tous droits
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.