ISO/IEC 27006:2011
Information technology — Security techniques — Requirements for bodies providing audit and certification of information security management systems
ISO/IEC 27006:2011 specifies requirements and provides guidance for bodies providing audit and certification of an information security management system (ISMS), in addition to the requirements contained within ISO/IEC 17021 and ISO/IEC 27001. It is primarily intended to support the accreditation of certification bodies providing ISMS certification.
The requirements contained in ISO/IEC 27006:2011 need to be demonstrated in terms of competence and reliability by any body providing ISMS certification, and the guidance contained in ISO/IEC 27006:2011 provides additional interpretation of these requirements for any body providing ISMS certification.
| Get this standard | Prices exclude GST | |
|---|---|---|
| PDF ( Single user document) |
$118.26 NZD
|
|
| HardCopy |
$152.17 NZD
|
|
| Networkable PDF |
Price varies
|
1 Scope
2 Normative references
3 Terms and definitions
4 Principles
5 General requirements
5.1 Legal and contractual matter
5.2 Management of impartiality
5.2.1 IS 5.2 Conflicts of interest
5.3 Liability and financing
6 Structural requirements
6.1 Organizational structure and top management
6.2 Committee for safeguarding impartiality
7 Resource requirements
7.1 Competence of management and personnel
7.1.1 IS 7.1.1 General considerations
7.1.1.1 Competence analysis and contract review
7.1.1.2 Resources
7.1.2 IS 7.1.2 Determination of Competence Criteria
7.2 Personnel involved in the certification activities
7.2.1 IS 7.2 Competence of certification body personnel
7.2.1.1 Training of audit teams
7.2.1.1.1 When selecting the audit team to be appointed for a specific certification audit the certification body shall ensure that the skills brought to each assignment are appropriate. The team shall
7.2.1.1.2 When required, the audit team may be complemented by technical experts who can demonstrate specific competence in a field of technology appropriate to the audit. Note should be taken that technical experts cannot be used in place of ISMS auditors but could advise auditors on matters of technical adequacy in the context of the management system being subjected to audit. The certification body shall have a procedure for
7.2.1.2 Management of the decision taking process
7.2.1.3 Pre-requisite levels of education, work experience, auditor training and audit experience for auditors conducting ISMS audits
7.2.1.3.1 The following criteria shall be applied for each auditor in the ISMS audit team. The auditor shall
7.2.1.3.2 In addition to the requirements in 7.2.1.3.1, audit team leaders shall fulfil the following requirements, which shall be demonstrated in audits under guidance and supervision:
7.3 Use of individual external auditors and external technical experts
7.3.1 IS 7.3 Using external auditors or external technical experts as part of the audit team
7.3.1.1 Use of technical experts
7.4 Personnel records
7.5 Outsourcing
8 Information requirements
8.1 Publicly accessible information
8.1.1 IS 8.1 Procedures for granting, maintaining, extending, reducing, suspending and withdrawing certification
8.2 Certification documents
8.2.1 IS 8.2 ISMS Certification documents
8.3 Directory of certified clients
8.4 Reference to certification and use of marks
8.4.1 IS 8.4 Control of certification marks
8.5 Confidentiality
8.5.1 IS 8.5 Access to organizational records
8.6 Information exchange between a certification body and its clients
9 Process requirements
9.1 General requirements
9.1.1 IS 9.1.1 General ISMS audit requirements
9.1.1.1 Certification audit criteria
9.1.1.2 Policies and procedures
9.1.1.3 Audit team
9.1.2 IS 9.1.2 Scope of certification
9.1.3 IS 9.1.3 Audit time
9.1.4 IS 9.1.4 Multiple sites
9.1.5 IS 9.1.5 Audit Methodology
9.1.6 IS 9.1.6 Certification Audit Report
9.2 Initial audit and certification
9.2.1 IS 9.2.1 Audit team competence
9.2.1.1 IS 9.2.1.1 Demonstration of auditor competence
9.2.2 IS 9.2.2 General preparations for the initial audit
9.2.3 IS 9.2.3 Initial certification audit
9.2.3.1 IS 9.2.3.1 Stage 1 audit
9.2.3.2 IS 9.2.3.2 Stage 2 audit
9.2.3.3 IS 9.2.3.3 Specific elements of the ISMS audit
9.2.3.3.1 Legal and regulatory compliance
9.2.3.3.2 Integration of ISMS documentation with that for other management systems
9.2.3.3.3 Combining management system audits
9.2.4 IS 9.2.4 Information for granting initial certification
9.2.5 IS 9.2.5 Certification decision
9.3 Surveillance activities
9.3.1 IS 9.3 Surveillance audits
9.4 Recertification
9.4.1 IS 9.4 Recertification audits
9.5 Special audits
9.5.1 IS 9.5 Special cases
9.6 Suspending, withdrawing or reducing scope of certification
9.7 Appeals
9.8 Complaints
9.8.1 IS 9.8 Complaints
9.9 Records of applicants and clients
10 Management system requirements for certification bodies
10.1 Options
10.2 Option 1 – Management system requirements in accordance with ISO 9001
10.3 Option 2 – General management system requirements
10.3.1 IS 10.3 ISMS implementation
A.1 Organization’s risk potential
A.2 Sector-specific categories of information security risk
B.1 General competence considerations
B.2 Specific competence considerations
B.2.1 Knowledge of ISO/IEC 27001:2005, Annex A controls
B.2.2 Typical knowledge related to ISMS
C.3.1 General
C.3.2 Explanation of terms
Previous versions
Keep me up-to-date
Sign up to receive updates when there are changes to this standard
Related Information
Similar Standards
-
AS/NZS 50004:2023
Energy management systems — Guidance for the implementation, maintenance and improvement of an AS/NZS ISO 50001 energy management system (ISO 50004:2020, (E.D. 1.0), MOD)
-
AS/NZS ISO 10006:2018
Quality management - Guidelines for quality management in projects -
AS/NZS ISO 30302:2023
Information and documentation - Management systems for records - Guidelines for implementation
-
AS/NZS ISO 50001:2021
Energy management systems - Requirements with guidance for use
1 Scope
2 Normative references
3 Terms and definitions
4 Principles
5 General requirements
5.1 Legal and contractual matter
5.2 Management of impartiality
5.2.1 IS 5.2 Conflicts of interest
5.3 Liability and financing
6 Structural requirements
6.1 Organizational structure and top management
6.2 Committee for safeguarding impartiality
7 Resource requirements
7.1 Competence of management and personnel
7.1.1 IS 7.1.1 General considerations
7.1.1.1 Competence analysis and contract review
7.1.1.2 Resources
7.1.2 IS 7.1.2 Determination of Competence Criteria
7.2 Personnel involved in the certification activities
7.2.1 IS 7.2 Competence of certification body personnel
7.2.1.1 Training of audit teams
7.2.1.1.1 When selecting the audit team to be appointed for a specific certification audit the certification body shall ensure that the skills brought to each assignment are appropriate. The team shall
7.2.1.1.2 When required, the audit team may be complemented by technical experts who can demonstrate specific competence in a field of technology appropriate to the audit. Note should be taken that technical experts cannot be used in place of ISMS auditors but could advise auditors on matters of technical adequacy in the context of the management system being subjected to audit. The certification body shall have a procedure for
7.2.1.2 Management of the decision taking process
7.2.1.3 Pre-requisite levels of education, work experience, auditor training and audit experience for auditors conducting ISMS audits
7.2.1.3.1 The following criteria shall be applied for each auditor in the ISMS audit team. The auditor shall
7.2.1.3.2 In addition to the requirements in 7.2.1.3.1, audit team leaders shall fulfil the following requirements, which shall be demonstrated in audits under guidance and supervision:
7.3 Use of individual external auditors and external technical experts
7.3.1 IS 7.3 Using external auditors or external technical experts as part of the audit team
7.3.1.1 Use of technical experts
7.4 Personnel records
7.5 Outsourcing
8 Information requirements
8.1 Publicly accessible information
8.1.1 IS 8.1 Procedures for granting, maintaining, extending, reducing, suspending and withdrawing certification
8.2 Certification documents
8.2.1 IS 8.2 ISMS Certification documents
8.3 Directory of certified clients
8.4 Reference to certification and use of marks
8.4.1 IS 8.4 Control of certification marks
8.5 Confidentiality
8.5.1 IS 8.5 Access to organizational records
8.6 Information exchange between a certification body and its clients
9 Process requirements
9.1 General requirements
9.1.1 IS 9.1.1 General ISMS audit requirements
9.1.1.1 Certification audit criteria
9.1.1.2 Policies and procedures
9.1.1.3 Audit team
9.1.2 IS 9.1.2 Scope of certification
9.1.3 IS 9.1.3 Audit time
9.1.4 IS 9.1.4 Multiple sites
9.1.5 IS 9.1.5 Audit Methodology
9.1.6 IS 9.1.6 Certification Audit Report
9.2 Initial audit and certification
9.2.1 IS 9.2.1 Audit team competence
9.2.1.1 IS 9.2.1.1 Demonstration of auditor competence
9.2.2 IS 9.2.2 General preparations for the initial audit
9.2.3 IS 9.2.3 Initial certification audit
9.2.3.1 IS 9.2.3.1 Stage 1 audit
9.2.3.2 IS 9.2.3.2 Stage 2 audit
9.2.3.3 IS 9.2.3.3 Specific elements of the ISMS audit
9.2.3.3.1 Legal and regulatory compliance
9.2.3.3.2 Integration of ISMS documentation with that for other management systems
9.2.3.3.3 Combining management system audits
9.2.4 IS 9.2.4 Information for granting initial certification
9.2.5 IS 9.2.5 Certification decision
9.3 Surveillance activities
9.3.1 IS 9.3 Surveillance audits
9.4 Recertification
9.4.1 IS 9.4 Recertification audits
9.5 Special audits
9.5.1 IS 9.5 Special cases
9.6 Suspending, withdrawing or reducing scope of certification
9.7 Appeals
9.8 Complaints
9.8.1 IS 9.8 Complaints
9.9 Records of applicants and clients
10 Management system requirements for certification bodies
10.1 Options
10.2 Option 1 – Management system requirements in accordance with ISO 9001
10.3 Option 2 – General management system requirements
10.3.1 IS 10.3 ISMS implementation
A.1 Organization’s risk potential
A.2 Sector-specific categories of information security risk
B.1 General competence considerations
B.2 Specific competence considerations
B.2.1 Knowledge of ISO/IEC 27001:2005, Annex A controls
B.2.2 Typical knowledge related to ISMS
C.3.1 General
C.3.2 Explanation of terms