ISO/IEC 27006-1
ISO/IEC 27006-1:2024 — Information technology, cybersecurity and privacy protection — Requirements for bodies providing audit and certification of information security management systems — Part 1: General
(fourth edition)
Abstract
ISO/IEC 27006 part 1 "specifies requirements and provides guidance for bodies providing audit and certification of an information security management system (ISMS), in addition to the requirements contained within ISO/IEC 17021-1.
The requirements contained in [ISO/IEC 27006-1] are demonstrated in terms of competence and reliability by bodies providing ISMS certification. The guidance contained in [ISO/IEC 27006-1] provides additional interpretation of these requirements for bodies providing ISMS certification.
NOTE [ISO/IEC 27006-1] can be used as a criteria document for accreditation, peer assessment or other audit processes.”
[Source: ISO/IEC 27006-1:2024]
Introduction
Part 1 of ISO/IEC 27006 is the accreditation standard that guides certification bodies on the formal processes they must follow when auditing their clients’ Information Security Management Systems against ISO/IEC 27001 in order to certify or register them. The accreditation processes laid out in the standard give assurance that ISO/IEC 27001 certificates issued by accredited organisations are valid and meaningful.
Scope
The scope is to “specify requirements and provide guidance for bodies providing audit and certification of an information security management system (ISMS), in addition to the requirements contained within ISO/IEC 17021 and ISO/IEC 27001. It is primarily intended to support the accreditation of certification bodies providing ISMS certification.”
Any properly-accredited body providing ISO/IEC 27001 certificates must fulfill the requirements in ISO/IEC 27006 plus ISO/IEC 17021-1 and ISO 19011 in terms of their competence, suitability and reliability to perform their work properly. This is necessary to ensure that issued ISO/IEC 27001 certificates are meaningful, and truly indicate that the organisation has fully satisfied the requirements of ISO/IEC 27001. Since literally anyone can issue certificates without necessarily following the certification processes specified in this standard, even substantially non-conformant organisations could conceivably buy their ISMS certificates or simply ‘self-certify’ (assert rather than demonstrate conformity), discrediting the whole certification structure.
Structure
ISO/IEC 27006-1 specifies requirements and provides guidance for conformity auditing specifically in the context of ISMSs, in addition to the general accreditation requirements laid down by ISO/IEC 17021-1 and ISO 19011.
The certification process involves auditing the information security management system for conformity with ISO/IEC 27001. The information security control set is “not used for conformity assessment”, merely to determine that controls were included or excluded in accordance with ISO/IEC 27001 clause 6.1.3 d. A note to clause 9.1.1 states:
“It is possible for an organization to design its own necessary controls or to select them from any source, therefore it is possible that an organization is certified to ISO/IEC 27001 even though none of its necessary controls are those specified in ISO/IEC 27001:2022, Annex A.”
The standard follows the structure of ISO/IEC 27021-1 clause-by-clause, adding guidance specific to ISMS certifications where applicable - for example, in order to remain independent and objective, the certification body cannot also provide information security reviews or internal audits of the client’s ISMS. [Since no period is specified, this could be interpreted as a permanent or indefinite exclusion.]
Status
The first edition of ISO/IEC 27006 was published in 2007, incorporating and superseding the EA7/03 guidance on accredited certification processes.
The second edition was published in 2011, reflecting changes to ISO 17021.
Following revisions to ISO/IEC 27001, ISO 19011 and ISO/IEC 17021-1, the current third edition was substantially revised and published in 2015.
Minor wording changes were published as an amendment to the third edition in 2020.
The fourth edition was published as ISO/IEC 27006-1 in 2024. It builds upon two normative references - ISO/IEC 27021-1:2015 and ISO/IEC 27001:2022.
Meanwhile, SC 27 is working on the structure of ISO/IEC 27006-1 and other issues, including concerns raised but not entirely resolved in exchanges with CASCO.
See also ISO/IEC 27007 for guidance on auditing the management system element of an ISMS and ISO/IEC 27008 for guidance on auditing information security controls.
[A second part to '27006 was published in 2021 covering PIMS certification, and was renumbered in 2025 as ISO/IEC 27706.]
Commentary
Certification auditors have only a passing interest in the organisation’s information risks and information security controls that are being managed, sufficient to confirm that the ISMS is operational. It is largely assumed that any organisation with an operational ISMS in conformity with the standard is, in fact, managing its information risks diligently.
ISO/IEC 27001 gives organisations latitude on how they design and document their ISMS, and hence certification auditors cannot simply follow a straightforward conformity checklist: they need to understand both management systems and information risk and security concepts. As far as I’m concerned, that’s a good thing!
The requirement to specify the SoA on ISO/IEC 27001 certificates has the unfortunate side-effect of impeding maintenance updates to an ISMS if that would affect the SoA e.g. responding to newly-identified information risks or to incorporate additional controls. Since that hampers a fundamental principle or purpose of having a management system, it may constitute a substantive defect in ISO/IEC 27006-1 ... and perhaps other ISO management system standards too.