TS EN ISO/IEC 27006

TS EN ISO/IEC 27006 is the standard that sets requirements for bodies that perform auditing and certification of information security management systems (ISMS). It adds requirements and guidance on top of ISO/IEC 17021-1 and ISO/IEC 27001, focusing on how certification bodies should conduct ISMS certification with competence, reliability, and consistency.

Technical framework for ISMS certification bodies

In general technical terms, a certification body evaluates an organisation’s information security management system against ISO/IEC 27001, carries out the audit process, and makes certification decisions. In this setting, impartiality, auditor competence, audit programme control, and the reliability of certification decisions are central concerns. ISO/IEC 27006 addresses these points with ISMS-specific requirements and interpretive guidance, linking the general certification model to the particular technical nature of information security management.

What the scope means in practice

• The standard is aimed at bodies that certify ISMSs; it is not a standard for an organisation’s own information security controls.
• It works together with ISO/IEC 17021-1 and ISO/IEC 27001 by adding further requirements and guidance.
• The scope states that it is primarily intended to support the accreditation of certification bodies providing ISMS certification.
• It can also serve as a criteria document for accreditation, peer assessment, or other audit processes.

This TSE entry refers to a withdrawn edition, but the subject remains a key reference for understanding competence, reliability, and decision integrity in the ISMS certification ecosystem.