1、BSI Standards PublicationBS ISO/IEC 27006:2015Information technology Security techniques Requirements for bodiesproviding audit andcertification of informationsecurity management systemsBS ISO/IEC 27006:2015 BRITISH STANDARDNational forewordThis British Standard is the UK implementation of ISO/IEC27
2、006:2015. It supersedes BS ISO/IEC 27006:2011 which is withdrawn.The UK participation in its preparation was entrusted to TechnicalCommittee IST/33, IT - Security techniques.A list of organizations represented on this committee can beobtained on request to its secretary.This publication does not pur
3、port to include all the necessaryprovisions of a contract. Users are responsible for its correctapplication. The British Standards Institution 2015. Published by BSI StandardsLimited 2015ISBN 978 0 580 79568 8ICS 35.040Compliance with a British Standard cannot confer immunity fromlegal obligations.T
4、his British Standard was published under the authority of theStandards Policy and Strategy Committee on 31 October 2015.Amendments issued since publicationDate Text affectedBS ISO/IEC 27006:2015Information technology Security techniques Requirements for bodies providing audit and certification of in
5、formation security management systemsTechnologies de linformation Techniques de scurit Exigences pour les organismes procdant laudit et la certification des systmes de management de la scurit de linformationINTERNATIONAL STANDARDISO/IEC27006Reference numberISO/IEC 27006:2015(E)Third edition2015-10-0
6、1 ISO/IEC 2015BS ISO/IEC 27006:2015ii ISO/IEC 2015 All rights reservedCOPYRIGHT PROTECTED DOCUMENT ISO/IEC 2015, Published in SwitzerlandAll rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mec
7、hanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below or ISOs member body in the country of the requester.ISO copyright officeCh. de Blandonnet 8 CP 401CH-1214 Vernier, Geneva, Sw
8、itzerlandTel. +41 22 749 01 11Fax +41 22 749 09 47copyrightiso.orgwww.iso.orgISO/IEC 27006:2015(E)BS ISO/IEC 27006:2015ISO/IEC 27006:2015(E)Foreword vIntroduction vi1 Scope . 12 Normative references 13 Terms and definitions . 14 Principles . 15 General requirements . 25.1 Legal and contractual matte
9、rs . 25.2 Management of impartiality 25.2.1 IS 5.2 Conflicts of interest 25.3 Liability and financing 26 Structural requirements 27 Resource requirements . 27.1 Competence of personnel 27.1.1 IS 7.1.1 General considerations . 37.1.2 IS 7.1.2 Determination of Competence Criteria 37.2 Personnel involv
10、ed in the certification activities 67.2.1 IS 7.2 Demonstration of auditor knowledge and experience 67.3 Use of individual external auditors and external technical experts 77.3.1 IS 7.3 Using external auditors or external technical experts as part of the audit team 77.4 Personnel records. 77.5 Outsou
11、rcing 78 Information requirements . 88.1 Public information . 88.2 Certification documents 88.2.1 IS 8.2 ISMS Certification documents . 88.3 Reference to certification and use of marks 88.4 Confidentiality . 88.4.1 IS 8.4 Access to organizational records 88.5 Information exchange between a certifica
12、tion body and its clients . 89 Process requirements . 89.1 Pre-certification activities . 89.1.1 Application 89.1.2 Application review . 99.1.3 Audit programme 99.1.4 Determining audit time . 109.1.5 Multi-site sampling .109.1.6 Multiple management systems . 119.2 Planning audits 119.2.1 Determining
13、 audit objectives, scope and criteria .119.2.2 Audit team selection and assignments 129.2.3 Audit plan 129.3 Initial certification 139.3.1 IS 9.3.1 Initial certification audit . 139.4 Conducting audits 149.4.1 IS 9.4 General . 149.4.2 IS 9.4 Specific elements of the ISMS audit 149.4.3 IS 9.4 Audit r
14、eport .149.5 Certification decision 159.5.1 IS 9.5 Certification decision . 15 ISO/IEC 2015 All rights reserved iiiContents PageBS ISO/IEC 27006:2015ISO/IEC 27006:2015(E)9.6 Maintaining certification . 159.6.1 General. 159.6.2 Surveillance activities .159.6.3 Re-certification .169.6.4 Special audits
15、 . 179.6.5 Suspending, withdrawing or reducing the scope of certification .179.7 Appeals . 179.8 Complaints . 179.8.1 IS 9.8 Complaints 179.9 Client records 1710 Management system requirements for certification bodies .1710.1 Options 1710.1.1 IS 10.1 ISMS implementation . 1710.2 Option A: General ma
16、nagement system requirements .1710.3 Option B: Management system requirements in accordance with ISO 9001.17Annex A (informative) Knowledge and skills for ISMS auditing and certification .18Annex B (normative) Audit time 20Annex C (informative) Methods for audit time calculations .25Annex D (informa
17、tive) Guidance for review of implemented ISO/IEC 27001:2013, Annex A controls 28Bibliography .35iv ISO/IEC 2015 All rights reservedBS ISO/IEC 27006:2015ISO/IEC 27006:2015(E)ForewordISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form t
18、he specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC tech
19、nical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1.Th
20、e procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the different types of document should be noted. This document was drafted in accordance with the editor
21、ial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. Details of any paten
22、t rights identified during the development of the document will be in the Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents).Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.For an
23、 explanation on the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISOs adherence to the WTO principles in the Technical Barriers to Trade (TBT) see the following URL: Foreword - Supplementary informationThe committee responsible for this
24、 document is ISO/IEC JTC 1, Information technology, SC 27, IT Security techniques.ISO/IEC 27006 was prepared by the Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 27, IT Security techniques.This third edition cancels and replaces the second edition (ISO/IEC 27006:20
25、11), which has been technically revised. ISO/IEC 2015 All rights reserved vBS ISO/IEC 27006:2015ISO/IEC 27006:2015(E)IntroductionISO/IEC 17021-1 sets out criteria for bodies operating audit and certification of management systems. If such bodies are to be accredited as complying with ISO/IEC 17021-1
26、 with the objective of auditing and certifying information security management systems (ISMS) in accordance with ISO/IEC 27001:2013, some additional requirements and guidance to ISO/IEC 17021-1 are necessary. These are provided by this International Standard.The text in this International Standard f
27、ollows the structure of ISO/IEC 17021-1 and the additional ISMS-specific requirements and guidance on the application of ISO/IEC 17021-1 for ISMS certification are identified by the letters “IS”.The term “shall” is used throughout this International Standard to indicate those provisions which, refle
28、cting the requirements of ISO/IEC 17021-1 and ISO/IEC 27001, are mandatory. The term “should” is used to indicate recommendation.The primary purpose of this International Standard is to enable accreditation bodies to more effectively harmonize their application of the standards against which they ar
29、e bound to assess certification bodies.Throughout this International Standard, the terms “management system” and “system” are used interchangeably. The definition of a management system can be found in ISO 9000:2005. The management system as used in this International Standard is not to be confused
30、with other types of systems, such as IT systems.vi ISO/IEC 2015 All rights reservedBS ISO/IEC 27006:2015Information technology Security techniques Requirements for bodies providing audit and certification of information security management systems1 ScopeThis International Standard specifies requirem
31、ents and provides guidance for bodies providing audit and certification of an information security management system (ISMS), in addition to the requirements contained within ISO/IEC 17021-1 and ISO/IEC 27001. It is primarily intended to support the accreditation of certification bodies providing ISM
32、S certification.The requirements contained in this International Standard need to be demonstrated in terms of competence and reliability by any body providing ISMS certification, and the guidance contained in this International Standard provides additional interpretation of these requirements for an
33、y body providing ISMS certification.NOTE This International Standard can be used as a criteria document for accreditation, peer assessment or other audit processes.2 Normative referencesThe following documents, in whole or in part, are normatively referenced in this document and are indispensable fo
34、r its application. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.ISO/IEC 17021-1:2015, Conformity assessment Requirements for bodies providing audit and certification of management system
35、s Part 1: RequirementsISO/IEC 27000, Information technology Security techniques Information security management systems Overview and vocabularyISO/IEC 27001:2013, Information technology Security techniques Information security management systems Requirements3 Terms and definitionsFor the purposes of
36、 this document, the terms and definitions given in ISO/IEC 17021-1, ISO/IEC 27000 and the following apply.3.1certification documentsdocuments indicating that a clients ISMS conforms to specified ISMS standards and any supplementary documentation required under the system4 PrinciplesThe principles fr
37、om ISO/IEC 17021-1, 4 apply.INTERNATIONAL STANDARD ISO/IEC 27006:2015(E) ISO/IEC 2015 All rights reserved 1BS ISO/IEC 27006:2015ISO/IEC 27006:2015(E)5 General requirements5.1 Legal and contractual mattersThe requirements of ISO/IEC 17021-1, 5.1 apply.5.2 Management of impartialityThe requirements of
38、 ISO/IEC 17021-1, 5.2 apply. In addition, the following requirements and guidance apply.5.2.1 IS 5.2 Conflicts of interestCertification bodies may carry out the following duties without them being considered as consultancy or having a potential conflict of interest:a) arranging and participating as
39、a lecturer in training courses, provided that, where these courses relate to information security management, related management systems or auditing, certification bodies shall confine themselves to the provision of generic information and advice which is publicly available, i.e. they shall not prov
40、ide company-specific advice which contravenes the requirements of b) below;b) making available or publishing on request information describing the certification bodys interpretation of the requirements of the certification audit standards (see 9.1.3.6);c) activities prior to audit, solely aimed at d
41、etermining readiness for certification audit; however, such activities shall not result in the provision of recommendations or advice that would contravene this clause and the certification body shall be able to confirm that such activities do not contravene these requirements and that they are not
42、used to justify a reduction in the eventual certification audit duration;d) performing second and third-party audits according to standards or regulations other than those being part of the scope of accreditation;e) adding value during certification audits and surveillance visits, e.g. by identifyin
43、g opportunities for improvement, as they become evident during the audit, without recommending specific solutions.The certification body shall not provide internal information security reviews of the clients ISMS subject to certification. Furthermore, the certification body shall be independent from
44、 the body or bodies (including any individuals) which provide the internal ISMS audit.5.3 Liability and financingThe requirements of ISO/IEC 17021-1, 5.3 apply.6 Structural requirementsThe requirements of ISO/IEC 17021-1, 6 apply.7 Resource requirements7.1 Competence of personnelThe requirements of
45、ISO/IEC 17021-1, 7.1 apply. In addition, the following requirements and guidance apply.2 ISO/IEC 2015 All rights reservedBS ISO/IEC 27006:2015ISO/IEC 27006:2015(E)7.1.1 IS 7.1.1 General considerations7.1.1.1 Generic competence requirementsThe certification body shall ensure that it has knowledge of
46、the technological, legal and regulatory developments relevant to the ISMS of the client which it assesses.The certification body shall define the competence requirements for each certification function as referenced in Table A.1 of ISO/IEC 17021-1. The certification body shall take into account all
47、the requirements specified in ISO/IEC 17021-1 and 7.1.2 and 7.2.1 of this International Standard that are relevant for the ISMS technical areas as determined by the certification body.NOTE Annex A provides a summary of the competence requirements for personnel involved in specific certification func
48、tions.7.1.2 IS 7.1.2 Determination of Competence Criteria7.1.2.1 Competence requirements for ISMS auditing7.1.2.1.1 General requirementsThe certification body shall have criteria for verifying the background experience, specific training or briefing of audit team members that ensures at least:a) kno
49、wledge of information security;b) technical knowledge of the activity to be audited;c) knowledge of management systems;d) knowledge of the principles of auditing;NOTE Further information on the principles of auditing can be found in ISO 19011.e) knowledge of ISMS monitoring, measurement, analysis and evaluation.These above requirements a) to e) apply to all auditors being part of the audit team, with the exception of b), which can be shared among auditors being part of the audit team.The audit team shall be competen
