ISO/IEC 27006:2015 — Information technology — Security techniques — Requirements for bodies providing audit and certification of information security management systems (third edition)
ISO/IEC 27006 is the accreditation standard that guides certification bodies on the formal processes they must follow when auditing their clients’ Information Security Management Systems (ISMSs) against ISO/IEC 27001 in order to certify or register them compliant. The accreditation processes laid out in the standard give assurance that ISO/IEC 27001 certificates issued by accredited organizations are valid.
Scope and purpose
The scope of ISO/IEC 27006 is to “specify requirements and provide guidance for bodies providing audit and certification of an information security management system (ISMS), in addition to the requirements contained within ISO/IEC 17021 and ISO/IEC 27001. It is primarily intended to support the accreditation of certification bodies providing ISMS certification.”
Any properly-accredited body providing ISO/IEC 27001 compliance certificates must fulfill the requirements in ISO/IEC 27006 plus ISO/IEC 17021-1 and ISO 19011 in terms of their competence, suitability and reliability to perform their work properly. This is necessary to ensure that issued ISO/IEC 27001 certificates are meaningful: if literally anyone were able to issue certificates without necessarily following the certification processes specified by ISO/IEC 27006, even seriously non-compliant organizations could conceivably buy their certificates or self-certify.
ISO/IEC 27006 specifies requirements and provides guidance for compliance auditing specifically in the context of ISMSs, in addition to the general accreditation requirements laid down by ISO/IEC 17021-1 and ISO 19011.
The certification process involves auditing the management system for compliance with ISO/IEC 27001. Certification auditors have only a passing interest in the actual information risks and the security controls that are being managed by the management system. It is assumed that any organization with a compliant ISMS is in fact managing its information risks diligently.
Status of the standard
ISO/IEC 27006 was first published in 2007, incorporating and superseding the EA7/03 guidance on accredited certification processes.
After ISO 17021 was revised, a fast-track update was made and a slightly-revised second edition of ISO/IEC 27006 was published in 2011. The standard was then reviewed in parallel with the revision of ISO 19011 and ISO/IEC 17021-1, following release of the 2013 version of ISO/IEC 27001.
The current third edition was published in 2015.
There are concerns over the mixture of ‘should’ and ‘shall’ forms, and several other inconsistencies and errors in the text, hence pressure now to fast-track the revision of 27006.
Meanwhile minor wording changes are in the works as an amendment, due to be published in 2020.
One of the issues with the 3rd edition concerns the advice to base the number of audit days required on how many employees the organization has - a curious suggestion at best. Number of employees or organizational size has some relevance, I guess, but surely the number of audit days is best determined by the auditors, ideally based on their experience with auditing ISMSs at similar organizations of similar maturity in similar industries? Essentially, it’s a risk-based determination, specifically audit risk, a particular form of information risk. If auditors can’t be trusted to work this out for themselves, discussing and agreeing the plan with their client, then there are bigger issues at stake than audit days.
The third edition of this standard is substantially different to the previous two due to substantive changes in the standards on which it is based. In general, ISO certification processes are being aligned and streamlined to make them more consistent across various fields e.g. the management systems for quality, environmental protection and information security. The advantages of such alignment include:
- Standardization and cross-fertilization between the fields of certification (e.g. an organization’s “quality assurance manual” should not be totally alien to someone familiar with its “information security manual” - ‘someone’ being staff, managers, auditors and interested third parties);
- Easier awareness, training and cross-training of auditors for various types of certification compliance audits, and for wider-scope internal audits;
- Easier awareness, training and cross-training of employees for various management systems;
- More consistent certification, surveillance and re-certification audit processes;
- Greater auditor and auditee familiarity with the process through greater practice, increasing the focus on the findings and the outcome;
- More possibility for multiple parallel certifications, perhaps reducing costs;
- A larger pool of qualified candidates for jobs associated with designing, implementing, operating and auditing the management systems.
On the downside, there may be some disgruntlement as the new order takes root.
It has been pointed out that the new version of 27001 gives organizations more latitude on how they design and document their ISMS, and hence certification auditors cannot determine compliance as easily: they will need greater knowledge of both management systems and information security concepts. Personally, I think that’s a good thing!
If your organization is sufficiently concerned about another’s compliance with ISO/IEC 27001 to ask to see their certificate, you should validate that the certificate is genuine, was in fact issued for that organization by an accredited certification body, is current and covers the appropriate ISMS (which means you should check the scope and SoA too!). Otherwise, why bother asking to see it? You might as well just take their word for it. “Oh yeh, we’re secure, we’re certified, we’re compliant, yada yada yada”.
The requirement to specify the SoA on an ISO/IEC 27001 compliance certificate has the unfortunate side-effect of impeding updating or maintaining an ISMS where that would affect the SoA e.g. responding to newly identified information risks or incorporate additional controls. Since that goes against a fundamental principle or purpose of having a management system, it may constitute a further substantive defect in ISO/IEC 27006 and perhaps other ISO27k standards too.
< Previous standard ^ Up a level ^ Next standard >