TS EN ISO/IEC 27006-1

TS EN ISO/IEC 27006-1 is a general requirements standard for bodies that audit and certify information security management systems. Its focus is how those bodies apply additional requirements and guidance specific to information security, cybersecurity and privacy protection on top of the framework in ISO/IEC 17021-1.

The certification-body framework for ISMS work

ISMS certification is built around assessing how an organization manages information assets and implements risk-based controls. For certification bodies in this field, competence, impartiality, audit methods, auditor capability and consistency of certification decisions are central concerns. ISO/IEC 27006-1 sits as an overarching standard that adapts general certification principles to the information security management context.

Relationship with ISO/IEC 17021-1

The document does not describe a standalone certification system; it defines ISMS-specific requirements to be used in addition to ISO/IEC 17021-1. That means the common structure of management-system certification is retained, while the terminology, audit approach and expertise needs associated with information security are brought into sharper focus. In practice, certification bodies are expected to consider not only administrative processes but also the technical and organizational characteristics that come with information security management systems.

• Applies to bodies providing audit and certification of information security management systems.
• Adds requirements and guidance to ISO/IEC 17021-1.
• Addresses information security, cybersecurity and privacy protection together.
• Strengthens the framework for competence and consistent certification practice.