ISO/IEC 27006

ISO/IEC 27006 is an information security standard published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Part of the ISO/IEC 27000 series of ISO/IEC Information Security Management System (ISMS) standards, it is titled Information technology - Security techniques - Requirements for bodies providing audit and certification of information security management systems.

ISO/IEC 27006 lays out formal requirements for accredited organizations which certify other organizations compliant with ISO/IEC 27001.

It effectively replaces EA 7/03 (Guidelines for the Accreditation of bodies operating certification/ registration of. Information Security Management Systems).

The standard helps ensure that ISO/IEC 27001 certificates issued by accredited organizations are meaningful and trustworthy, in other words it is a matter of assurance.

Description of standard

ISO 27006 outlines requirements to be accredited for third parties who audit and certify information security management systems (ISMS), in addition to the requirements set by ISO 17021 1 and ISO 27001. This standard was first published in 2007, and it had to be revised twice due to significant changes made to ISO 17021 standard. The current version is ISO 27006 third edition published in 2015.[1]

ISO 27006:2015 sets standards for demonstration of ISMS auditors' competence. Certification Body auditing ISMS is required to verify each auditor on the auditing team has the knowledge of:

  • ISMS monitoring, measurement, analysis, and evaluation,
  • Information security,
  • Management systems,
  • Auditing principles, and
  • Technical knowledge of systems to be audited.

All auditors on the team must collectively be versed in information systems management terminology, principles, and techniques. They must know all requirements from ISO 27001, all controls listed in ISO 27002. Also, auditors must be aware of business management practices, the legal and regulatory requirements in a particular information systems field, geography, and jurisdictions.

Competence must also be demonstrated by personnel reviewing the audits and making certification decisions. They need to have sufficient knowledge to verify the accuracy of the certification scope. Also, they need to have general knowledge of management systems, audit procedures, principles, and techniques.

ISO27006:2015 also outlines adequate education, professional development, training covering ISMS audits, and current/relevant experience level.[2]

Intent of standard

The primary intent of ISO 27006 is to support the accreditation for third parties certifying the information security management system. Any accredited third-party auditing and confirming compliance with ISO 27001 must follow the requirements in this standard to ensure the ISMS certifications are valid. Accredited third parties need to demonstrate their competence and reliability.

Application

A mid-size organization seeking ISO 27001 certification need to hire an accredited certification body to complete ISMS certification audit. The organization should complete due diligence to ensure the selected auditing firm complies with ISO27006:2015 standard. During the audit, the organization should ensure all documentation necessary to complete the audit is available, provide the auditing team ISMS records, including but limited to information about ISMS design and effectiveness of the controls.

See also

References

  1. ^ "ISO/IEC 27006:2015 - Information technology -- Security techniques -- Requirements for bodies providing audit and certification of information security management systems". www.iso.org. Retrieved 2018-07-02.
  2. ^ "ISO/IEC 27006:2015 Information technology - Security techniques - Requirements for bodies providing audit and certification of information security management systems". Joint Technical Committee ISO/IEC JTC 1 - Information Technology and Subcommittee SC 27 - IT security techniques. January 10, 2015 – via Distributed through American National Standards Institute (ANSI).

External links

ECOGRA

eCOGRA (eCommerce Online Gaming Regulation and Assurance) is a London-based internationally approved testing agency, accredited certification body and player protection and standards organisation. The company was established in 2003 in the United Kingdom and introduced the first formal self-regulation program to the online gambling industry in 2003. eCOGRA is also a leading independent and internationally approved testing agency and certification body, specializing in the certification of online gaming software and the audit of Information Security Management Systems.

The organisation has been awarded the United Kingdom Accreditation Service (UKAS) ISO approval ISO/IEC17025:2005 : General Requirements for the competence of testing and calibration laboratories for the United Kingdom and Denmark, and ISO approval ISO/IEC 17021-1:2015 – Requirements for bodies providing audit and certification of management systems.

ISO/IEC 27000-series

The ISO/IEC 27000-series (also known as the 'ISMS Family of Standards' or 'ISO27K' for short) comprises information security standards published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).The series provides best practice recommendations on information security management - the management of information risks through information security controls - within the context of an overall Information security management system (ISMS), similar in design to management systems for quality assurance (the ISO 9000 series), environmental protection (the ISO 14000 series) and other management systems.The series is deliberately broad in scope, covering more than just privacy, confidentiality and IT/technical/cybersecurity issues. It is applicable to organizations of all shapes and sizes. All organizations are encouraged to assess their information risks, then treat them (typically using information security controls) according to their needs, using the guidance and suggestions where relevant. Given the dynamic nature of information risk and security, the ISMS concept incorporates continuous feedback and improvement activities to respond to changes in the threats, vulnerabilities or impacts of incidents.

The standards are the product of ISO/IEC JTC1 (Joint Technical Committee 1) SC27 (Subcommittee 27), an international body that meets in person twice a year.

The ISO/IEC standards are sold directly by ISO, mostly in English, French and Chinese. Sales outlets associated with various national standards bodies also sell directly translated versions in other languages.

ISO/IEC 27001

ISO/IEC 27001 is an information security standard, part of the ISO/IEC 27000 family of standards, of which the last version was published in 2013, with a few minor updates since then. It is published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) under the joint ISO and IEC subcommittee, ISO/IEC JTC 1/SC 27.ISO/IEC 27001 specifies a management system that is intended to bring information security under management control and gives specific requirements. Organizations that meet the requirements may be certified by an accredited certification body following successful completion of an audit.

ISO/IEC JTC 1/SC 27

ISO/IEC JTC 1/SC 27 IT Security techniques is a standardization subcommittee of the Joint Technical Committee ISO/IEC JTC 1 of the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). ISO/IEC JTC 1/SC 27 develops International Standards, Technical Reports, and Technical Specifications within the field of information and IT security. Standardization activity by this subcommittee includes general methods, management system requirements, techniques and guidelines to address both information security and privacy. Drafts of International Standards by ISO/IEC JTC 1 or any of its subcommittees are sent out to participating national standardization bodies for ballot, comments and contributions. Publication as an ISO/IEC International Standard requires approval by a minimum of 75% of the national bodies casting a vote. The international secretariat of ISO/IEC JTC 1/SC 27 is the Deutsches Institut für Normung (DIN) located in Germany.

List of International Organization for Standardization standards, 26000-27999

This is a list of published International Organization for Standardization (ISO) standards and other deliverables. For a complete and up-to-date list of all the ISO standards, see the ISO catalogue.The standards are protected by copyright and most of them must be purchased. However, about 300 of the standards produced by ISO and IEC's Joint Technical Committee 1 (JTC1) have been made freely and publicly available.

ISO standards by standard number
1–9999
10000–19999
20000+

This page is based on a Wikipedia article written by authors (here).
Text is available under the CC BY-SA 3.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.