Abstract 

ISO/IEC 27006:2011 specifies requirements and provides guidance for bodies providing audit and certification of an information security management system (ISMS), in addition to the requirements contained within ISO/IEC 17021 and ISO/IEC 27001. It is primarily intended to support the accreditation of certification bodies providing ISMS certification.

The requirements contained in ISO/IEC 27006:2011 need to be demonstrated in terms of competence and reliability by any body providing ISMS certification, and the guidance contained in ISO/IEC 27006:2011 provides additional interpretation of these requirements for any body providing ISMS certification.


General information

  • Status :  Withdrawn
    Publication date : 2011-12
  • Edition : 2
    Number of pages : 37
  • Technical Committee
    :
    ISO/IEC JTC 1/SC 27
    Information security, cybersecurity and privacy protection
  • ICS :
    35.030
    IT Security
    03.100.70
    Management systems

Life cycle

A standard is reviewed every 5 years



Revisions / Corrigenda

Got a question?

Check out our FAQs

Customer care
+41 22 749 08 88

Opening hours:
Monday to Friday - 09:00-12:00, 14:00-17:00 (UTC+1)

Keep up to date with ISO

Sign up to our newsletter for the latest news, views and product information