< Previous standard ^ Up a level ^ Next standard >
ISO/IEC 27006:2015 — Information technology — Security techniques — Requirements for bodies providing audit and certification of information security management systems (third edition)
ISO/IEC 27006 is the accreditation standard that guides certification bodies on the formal processes they must follow when auditing their clients’ Information Security Management Systems against ISO/IEC 27001 in order to certify or register them compliant. The accreditation processes laid out in the standard give assurance that ISO/IEC 27001 certificates issued by accredited organizations are valid and meaningful.
Scope and purpose
The scope of ISO/IEC 27006 is to “specify requirements and provide guidance for bodies providing audit and certification of an information security management system (ISMS), in addition to the requirements contained within ISO/IEC 17021 and ISO/IEC 27001. It is primarily intended to support the accreditation of certification bodies providing ISMS certification.”
Any properly-accredited body providing ISO/IEC 27001 compliance certificates must fulfill the requirements in ISO/IEC 27006 plus ISO/IEC 17021-1 and ISO 19011 in terms of their competence, suitability and reliability to perform their work properly. This is necessary to ensure that issued ISO/IEC 27001 compliant certificates are meaningful: if literally anyone were able to issue certificates without necessarily following the certification processes specified in this standard, even substantially non-compliant organizations could conceivably buy their ISMS certificates or simply ‘self-certify’ (assert rather than demonstrate compliance).
ISO/IEC 27006 specifies requirements and provides guidance for compliance auditing specifically in the context of ISMSs, in addition to the general accreditation requirements laid down by ISO/IEC 17021-1 and ISO 19011.
The certification process involves auditing the management system for compliance with ISO/IEC 27001. Certification auditors have only a passing interest in the actual information risks and the security controls that are being managed by the management system. It is assumed that any organization with a compliant ISMS is in fact managing its information risks diligently.
Status of the standard
ISO/IEC 27006 was first published in 2007, incorporating and superseding the EA7/03 guidance on accredited certification processes.
After ISO 17021 was revised, a fast-track update was made and a slightly-revised second edition of ISO/IEC 27006 was published in 2011. The standard was then reviewed in parallel with the revision of ISO 19011 and ISO/IEC 17021-1, following release of the 2013 version of ISO/IEC 27001.
The current third edition was published in 2015. There are concerns over the mixture of ‘should’ and ‘shall’ verb forms, and several other inconsistencies and errors in the text, hence pressure now to fast-track the revision of 27006. Meanwhile minor wording changes were published as an amendment at the end of March 2020.
One of the issues with the current third edition of 27006 concerns the advice to base the number of audit days required on how many employees the organization has - a curious suggestion at best. Number of employees or organizational size has some relevance, I guess, but surely the number of audit days is best determined by the auditors, ideally based on their experience with auditing ISMSs at similar organizations of similar maturity in similar industries? Essentially, it’s a risk-based determination, specifically audit risk, a particular form of information risk. If auditors can’t be trusted to work this out for themselves, discussing and agreeing the plan with their client, then there are bigger issues at stake than the number of planned audit days!
The third edition of this standard is substantially different to the previous two due to substantive changes in the standards on which it is based. In general, ISO certification processes are being aligned and streamlined to make them more consistent across various fields e.g. the management systems for quality, environmental protection and information security. The advantages of such alignment include:
- Standardization and cross-fertilization between the fields of certification (e.g. an organization’s “quality assurance manual” should not be totally alien to someone familiar with its “information security manual” - ‘someone’ being staff, managers, auditors and interested third parties);
- Easier awareness, training and cross-training of auditors for various types of certification compliance audits, and for wider-scope internal audits;
- Easier awareness, training and cross-training of employees for various management systems;
- More consistent certification, surveillance and re-certification audit processes;
- Greater auditor and auditee familiarity with the process through greater practice, increasing the focus on the findings and the outcome;
- More possibility for multiple parallel certifications, perhaps reducing costs;
- A larger pool of qualified candidates for jobs associated with designing, implementing, operating and auditing the management systems.
On the downside, there may be some disgruntlement as the new order takes root.
It has been pointed out that the current version of ISO/IEC 27001 gives organizations more latitude on how they design and document their ISMS, and hence certification auditors cannot determine compliance as easily: they need greater knowledge of both management systems and information security concepts. That’s good!
If your organization is sufficiently concerned about another’s compliance with ISO/IEC 27001 to ask to see their certificate, you should check that the certificate:
- Is genuine and current (ask the certification body to confirm);
- Was issued to that specific organization (not some minor subsidiary or legal/paper entity);
- Was issued by a certification body that is duly accredited to issue ISO/IEC 27001 compliance certificates (implying that they have suitable auditors who follow the specified certification processes);
- Covers the appropriate ISMS (so check the scope and SoA too!).
Otherwise, why even bother asking to see it? You might as well just take their word for it. “Oh yeh, we’re secure, we’re certified, we’re compliant blah blah”. Hint: you are accountable for your decision to rely on their certificate and any further assurance checks you undertake.
The requirement to specify the SoA on an ISO/IEC 27001 compliance certificate has the unfortunate side-effect of impeding updating or maintaining an ISMS where that would affect the SoA e.g. responding to newly-identified information risks or to incorporate additional controls. Since that hampers a fundamental principle or purpose of having a management system, it may constitute a further substantive defect in ISO/IEC 27006 ... and perhaps other ISO27k standards too.
ISO/IEC TS 27006-2 — Information security, cybersecurity and privacy protection — Requirements for bodies providing audit and certification of information security management systems — Part 2: Privacy information management systems (DRAFT)
Part 2 will be another accreditation standard guiding certification bodies on the formal processes they must follow when auditing their clients’ Privacy Information Management Systems against ISO/IEC 27701 and ISO/IEC 27001 in order to certify or register them compliant. The accreditation processes laid out in the standard will give assurance that ISO/IEC 27701 certificates issued by accredited organizations are valid and meaningful.
Scope and purpose
The scope of ISO/IEC TS 27006-2 is to:
“specify requirements and provide guidance for bodies providing audit and certification of a privacy information management system (PIMS) according to ISO/IEC 27701 in combination with ISO/IEC 27001, in addition to the requirements contained within ISO/IEC 27006 and ISO/IEC 27701. It is primarily intended to support the accreditation of certification bodies providing PIMS certification.”
This standard may also be used for peer assessment or other PIMS audit processes such as internal audits.
Any properly-accredited body providing ISO/IEC 27701 compliance certificates must fulfill the requirements in this standard plus the following normative standards:
- ISO/IEC 17021-1:2015 — Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 1: Requirements
- ISO/IEC 27006:2015 — Information technology — Security techniques — Requirements for bodies providing audit and certification of information security management systems
- ISO/IEC 27000 — Information technology — Security techniques — Information security management systems — Overview and vocabulary
- ISO/IEC 27001:2013 — Information technology — Security techniques — Information security management systems — Requirements
- ISO/IEC 27701:2019 — Information technology — Security techniques —Extension to ISO/IEC 27001 and ISO/IEC 27002 for Privacy Information Management — Requirements and Guidelines
- ISO/IEC 29100:2011 — Information technology — Security techniques — Privacy framework
Their competence, suitability and reliability to perform their work properly is necessary to ensure that issued ISO/IEC 27701 compliant certificates are meaningful: if literally anyone were able to issue PIMS certificates without necessarily following the certification processes specified by this standard, even substantially non-compliant organizations could conceivably buy their compliance certificates or simply ‘self-certify’ (assert rather than demonstrate compliance).
The standard will specify formal requirements and offer guidance for compliance auditing specifically in the context of PIMSs, in addition to the general accreditation requirements laid down by ISO/IEC 17021-1 and the other normative standards.
The certification process involves auditing the management system for compliance with ISO/IEC 27701. Certification auditors have only a passing interest in the actual privacy arangements that are being managed by the management system. It is assumed that any organization with a compliant PIMS is in fact managing its privacy arrangements diligently.
Most sections will confirm the requirements of the corresponding section of ISO/IEC 27006, with additional notes relevant to PIMS audits as appropriate e.g. the additional audit time anticipated for PIMS auditing as a proportion of that needed for ISMS certification audits.
Status of the standard
The SC 27 project set out in 2019, originally known as ISO/IEC 27558.
Part 2 is currently at Working Draft stage.
In the absence of formal guidance from the ISO27k standards, some certification bodies have responded to market demand for PIMS certification by developing proprietary (non-accredited) PIMS auditing and certification practices along similar lines to those for ISO/IEC 27001 and other management systems standards. ISO/IEC JTC 1/SC 27 has responded by attempting to fast-track this standard providing interim guidance, in the hope of maintaining global alignment, integrity and equivalence of the accredited certification processes. The race is on.
The standard follows the structure of ‘27006 with statements of the form “The requirements of ISO/IEC 27006, [section number] apply.” plus, for some sections, “In addition, the following requirements and guidance apply.” followed by briefly and formally stated requirements. For example, PIMS certification auditors obviously need to be familiar with ISO/IEC 27701 whereas ISMS certification auditors don’t.
< Previous standard ^ Up a level ^ Next standard >