The first edition of ISO/IEC 27006 was published in 2007, incorporating and superseding the EA7/03 guidance on accredited certification processes.

Each section mostly has statements of the form “The requirements of ISO/IEC 27006-1, [section number] apply.”  This avoids duplication. 27006-2 is based firmly on 27006-1.

Part 1 of ISO/IEC 27006 is the accreditation standard that guides certification bodies on the formal processes they must follow when auditing their clients’ Information Security Management Systems against ISO/IEC 27001 in order to certify or register them. The accreditation processes laid out in the standard give assurance that ISO/IEC 27001 certificates issued by accredited organisations are valid and meaningful.

Any properly-accredited body providing ISO/IEC 27001 certificates must fulfill the requirements in ISO/IEC 27006 plus ISO/IEC 17021-1 and ISO 19011 in terms of their competence, suitability and reliability to perform their work properly. This is necessary to ensure that issued ISO/IEC 27001 certificates are meaningful, and truly indicate that the organisation has fully satisfied the requirements of ISO/IEC 27001. Since literally anyone can issue certificates without necessarily following the certification processes specified in this standard, even substantially non-conformant organisations could conceivably buy their ISMS certificates or simply ‘self-certify’ (assert rather than demonstrate conformity), discrediting the whole certification structure.

As with ISO/IEC 27001 ISMS certification, ISO/IEC 27006-2 concerns the management system. For certification, an organisation is formally required to manage its privacy arrangements in accordance with all the mandatory requirements of ISO/IEC 27701 ... which is subtly different from actually having all the appropriate privacy arrangements in place. For compliance/conformity auditors, the challenge is that ‘appropriate’ is not formally specified in ISO/IEC 27701 but is determined by the organisation itself.

Meanwhile, SC 27 is working on the structure of ISO/IEC 27006-1 and other issues, including concerns raised but not entirely resolved in exchanges with CASCO.

The requirement to specify the SoA on ISO/IEC 27001 certificates has the unfortunate side-effect of impeding updating or maintaining an ISMS where that would affect the SoA e.g. responding to newly-identified information risks or to incorporate additional controls. Since that hampers a fundamental principle or purpose of having a management system, it may constitute a substantive defect in ISO/IEC 27006 ... and perhaps other ISO management system standards too.

As with part 1, the certification process involves auditing the management system (specifically) for conformity with ISO/IEC 27701. Certification auditors have only a passing interest in the actual privacy arrangements that are being managed by the management system, doing sufficient checks to confirm that the PIMS is operational. It is presumed that any organisation with a PIMS that conforms to the standard probably does in fact have suitable privacy controls in place, thanks to the operation of said PIMS. More subtly, the standard does not demand particular, detailed privacy arrangements that may be inappropriate or insufficient if implemented in practice, and hopefully reduces the possibility of assertive certification auditors seeking to second-guess or override informed management decisions about how the organisation is addressing its privacy risks. The auditors’ job is simply to provide assurance by assessing conformity with the mandatory requirements of the standard.

The standard specifies formal requirements and offers guidance for conformity auditing specifically in the context of PIMSs, in addition to the general accreditation requirements laid down by ISO/IEC 17021-1 and the other normative standards.

The scope is to “specify requirements and provide guidance for bodies providing audit and certification of an information security management system (ISMS), in addition to the requirements contained within ISO/IEC 17021 and ISO/IEC 27001. It is primarily intended to support the accreditation of certification bodies providing ISMS certification.”

Any properly-accredited body providing ISO/IEC 27701 certificates must fulfill the requirements in this standard plus the following normative standards (the latest editions unless dated):

ISO/IEC 27001 gives organisations latitude on how they design and document their ISMS, and hence certification auditors cannot simply follow a straightforward conformity checklist: they need to understand both management systems and information risk and security concepts. As far as I’m concerned, that’s a good thing!

Following revisions to ISO/IEC 27001, ISO 19011 and ISO/IEC 17021-1, the current third edition was substantially revised and published in 2015.

The certification process involves auditing the information security management system for conformity with ISO/IEC 27001. The information security control set is “not used for conformity assessment”, merely to determine that controls were included or excluded in accordance with ISO/IEC 27001 clause 6.1.3 d. A note to clause 9.1.1 states:

Certification auditors have only a passing interest in the organisation’s information risks and information security controls that are being managed, sufficient to confirm that the ISMS is operational. It is largely assumed that any organisation with an operational ISMS in conformity with the standard is, in fact, managing its information risks diligently.

This accreditation standard guides certification bodies on the formal processes they must follow when auditing their clients’ Privacy Information Management Systems against ISO/IEC 27701 and ISO/IEC 27001 in order to certify or register them. The accreditation processes laid out in the standard give assurance that ISO/IEC 27701 certificates issued by accredited organisations are valid, comparable and meaningful.

The fourth edition was published as ISO/IEC 27006-1 in March 2024. It builds upon two normative references - ISO/IEC 27021-1:2015 and ISO/IEC 27001:2022.

The standard follows the structure of ISO/IEC 27021-1 clause-by-clause, adding guidance specific to ISMS certifications where applicable - for example, in order to remain independent and objective, the certification body cannot also provide information security reviews or internal audits of the client’s ISMS. [Since no period is specified, this could be interpreted as a permanent or indefinite exclusion.]

Their competence, suitability and reliability to perform their work properly is necessary to ensure that issued ISO/IEC 27701 certificates are meaningful: if literally anyone were able to issue PIMS certificates without necessarily following the certification processes specified by this standard, even substantially non-conformant organisations could conceivably buy their certificates or simply ‘self-certify’ (assert rather than demonstrate conformity). Accreditation is an assurance control.

ISO/IEC 27006-1 specifies requirements and provides guidance for conformity auditing specifically in the context of ISMSs, in addition to the general accreditation requirements laid down by ISO/IEC 17021-1 and ISO 19011.

For some sections, additional requirements and guidance apply. For example, PIMS certification auditors obviously need to be familiar with ISO/IEC 27701 whereas ISMS certification auditors don’t.

The audit time anticipated for PIMS auditing is specified as a proportion of that needed for ISMS certification audits, paving the way for dual-certification for PIMS and ISMS. Personally, however, I am dubious about the need for the standards to specify audit time at all. I would feel more comfortable if accredited certification bodies’ auditors determined it for themselves, in negotiation with their management and clients, taking account of factors such as the size and complexity of the organisation, the scope of the PIMS, the amount of assurance required by third parties likely to rely on the certificates, the client and auditors’ liabilities if privacy breaches occur, and so forth. Perhaps I am naive to think that auditors will plan and conduct their assignments professionally and competently, without bowing to commercial pressure from the clients ...