Shopping Cart

No products in the cart.

BS EN ISO/IEC 27006-1:2024

$198.66

Information security, cybersecurity and privacy protection. Requirements for bodies providing audit and certification of information security management systems – General

Published By Publication Date Number of Pages
BSI 2024 56
Guaranteed Safe Checkout
Categories: ,

If you have any questions, feel free to reach out to our online customer service team by clicking on the bottom right corner. Weā€™re here to assist you 24/7.
Email:[email protected]

This document specifies requirements and provides guidance for bodies providing audit and certification of an information security management system (ISMS), in addition to the requirements contained within ISO/IEC 17021-1. The requirements contained in this document are demonstrated in terms of competence and reliability by bodies providing ISMS certification. The guidance contained in this document provides additional interpretation of these requirements for bodies providing ISMS certification. NOTE       This document can be used as a criteria document for accreditation, peer assessment or other audit processes.

PDF Catalog

PDF Pages PDF Title
2 undefined
4 European foreword
Endorsement notice
7 Foreword
8 Introduction
9 1 Scope
2 Normative references
3 Terms and definitions
12 4 Principles
13 5 General requirements
5.1 ā€‹Legal and contractual matters
5.2 Management of impartiality
5.2.1 General
5.2.2 Conflicts of interest
5.3 Liability and financing
6 Structural requirements
7 Resource requirements
7.1 Competence of personnel
7.1.1 General
7.1.2 Generic competence requirements
14 7.1.3 Determination of competence criteria
16 7.2 Personnel involved in the certification activities
7.2.1 General
7.2.2 Demonstration of auditor knowledge and experience
17 7.3 Use of individual external auditors and external technical experts
7.4 Personnel records
7.5 Outsourcing
8 Information requirements
8.1 Public information
8.2 ā€‹Certification documents
8.2.1 General
18 8.2.2 ISMS Certification documents
8.2.3 Reference of other standards in the ISMS certification documents
8.3 Reference to certification and use of marks
8.4 Confidentiality
8.4.1 General
8.4.2 Access to organizational records
8.5 Information exchange between a certification body and its clients
19 9 Process requirements
9.1 Pre-certification activities
9.1.1 Application
9.1.2 Application review
9.1.3 Audit programme
20 9.1.4 Determining audit time
21 9.1.5 Multi-site sampling
22 9.1.6 Multiple management systems
9.2 ā€‹Planning audits
9.2.1 Determining audit objectives, scope and criteria
9.2.2 Audit team selection and assignments
23 9.2.3 Audit plan
9.3 Initial certification
9.3.1 General
9.3.2 Initial certification audit
24 9.4 Conducting audits
9.4.1 General
9.4.2 Specific elements of the ISMS audit
9.4.3 Audit report
25 9.5 ā€‹Certification decision
9.5.1 General
9.5.2 ā€‹Certification decision
9.6 Maintaining certification
9.6.1 General
9.6.2 Surveillance activities
26 9.6.3 Re-certification
9.6.4 Special audits
9.6.5 Suspending, withdrawing or reducing the scope of certification
27 9.7 Appeals
9.8 Complaints
9.8.1 General
9.8.2 Complaints
9.9 Client records
10 ā€‹Management system requirements for certification bodies
10.1 Options
10.1.1 General
10.1.2 ISMS implementation
10.2 Option A: General management system requirements
10.3 Option B: Management system requirements in accordance with ISO 9001
28 Annex A (normative) Knowledge and skills for ISMS auditing and certification
29 Annex B (informative) Further competence considerations
31 Annex C (normative) Audit time
37 Annex D (informative) Methods for audit time calculations
41 Annex E (informative) Guidance for review of implemented ISO/IEC 27001:2022, Annex A controls
55 Bibliography
BS EN ISO/IEC 27006-1:2024
$198.66