BS EN ISO/IEC 27006-1:2024
$198.66
Information security, cybersecurity and privacy protection. Requirements for bodies providing audit and certification of information security management systems – General
Published By | Publication Date | Number of Pages |
BSI | 2024 | 56 |
This document specifies requirements and provides guidance for bodies providing audit and certification of an information security management system (ISMS), in addition to the requirements contained within ISO/IEC 17021-1. The requirements contained in this document are demonstrated in terms of competence and reliability by bodies providing ISMS certification. The guidance contained in this document provides additional interpretation of these requirements for bodies providing ISMS certification. NOTE This document can be used as a criteria document for accreditation, peer assessment or other audit processes.
PDF Catalog
PDF Pages | PDF Title |
---|---|
2 | undefined |
4 | European foreword Endorsement notice |
7 | Foreword |
8 | Introduction |
9 | 1 Scope 2 Normative references 3 Terms and definitions |
12 | 4 Principles |
13 | 5 General requirements 5.1 āLegal and contractual matters 5.2 Management of impartiality 5.2.1 General 5.2.2 Conflicts of interest 5.3 Liability and financing 6 Structural requirements 7 Resource requirements 7.1 Competence of personnel 7.1.1 General 7.1.2 Generic competence requirements |
14 | 7.1.3 Determination of competence criteria |
16 | 7.2 Personnel involved in the certification activities 7.2.1 General 7.2.2 Demonstration of auditor knowledge and experience |
17 | 7.3 Use of individual external auditors and external technical experts 7.4 Personnel records 7.5 Outsourcing 8 Information requirements 8.1 Public information 8.2 āCertification documents 8.2.1 General |
18 | 8.2.2 ISMS Certification documents 8.2.3 Reference of other standards in the ISMS certification documents 8.3 Reference to certification and use of marks 8.4 Confidentiality 8.4.1 General 8.4.2 Access to organizational records 8.5 Information exchange between a certification body and its clients |
19 | 9 Process requirements 9.1 Pre-certification activities 9.1.1 Application 9.1.2 Application review 9.1.3 Audit programme |
20 | 9.1.4 Determining audit time |
21 | 9.1.5 Multi-site sampling |
22 | 9.1.6 Multiple management systems 9.2 āPlanning audits 9.2.1 Determining audit objectives, scope and criteria 9.2.2 Audit team selection and assignments |
23 | 9.2.3 Audit plan 9.3 Initial certification 9.3.1 General 9.3.2 Initial certification audit |
24 | 9.4 Conducting audits 9.4.1 General 9.4.2 Specific elements of the ISMS audit 9.4.3 Audit report |
25 | 9.5 āCertification decision 9.5.1 General 9.5.2 āCertification decision 9.6 Maintaining certification 9.6.1 General 9.6.2 Surveillance activities |
26 | 9.6.3 Re-certification 9.6.4 Special audits 9.6.5 Suspending, withdrawing or reducing the scope of certification |
27 | 9.7 Appeals 9.8 Complaints 9.8.1 General 9.8.2 Complaints 9.9 Client records 10 āManagement system requirements for certification bodies 10.1 Options 10.1.1 General 10.1.2 ISMS implementation 10.2 Option A: General management system requirements 10.3 Option B: Management system requirements in accordance with ISO 9001 |
28 | Annex A (normative) Knowledge and skills for ISMS auditing and certification |
29 | Annex B (informative) Further competence considerations |
31 | Annex C (normative) Audit time |
37 | Annex D (informative) Methods for audit time calculations |
41 | Annex E (informative) Guidance for review of implemented ISO/IEC 27001:2022, Annex A controls |
55 | Bibliography |