TS EN ISO/IEC 27006-1

TS EN ISO/IEC 27006-1 is a standard for bodies that perform audit and certification of information security management systems (ISMS). Its focus is the competence and reliability of those bodies, providing an additional framework on top of the core certification requirements already contained in ISO/IEC 17021-1.

What it regulates for ISMS certification bodies

This standard does not describe how an audit itself is conducted step by step. Instead, it sets out the organizational requirements expected of a body issuing ISMS certification. Competent personnel, a consistent assessment approach, reliable decision-making, and impartial certification activities are central to the trust placed in ISMS certification. In general technical context, ISMS certification rests on concepts such as risk-based thinking, scope definition, evaluation of audit findings, and independence of the certification decision.

Use in accreditation and peer assessment

The document may also serve as a criteria document for accreditation, peer assessment, or other audit processes. That makes it a common reference point when judging whether a certification body is operating to the expected level of competence and reliability. For organizations involved in ISMS certification, it helps clarify the overarching framework and professional expectations, while detailed operational practice is interpreted alongside the underlying certification standard and the body’s own procedures.