Reference numberISO/IEC 27006:2007(E) © ISO/IEC 2007 INTERNATIONAL STANDARD ISO/IEC27006 First edition2007-03-01 Information technology — Security techniques — Requirements for bodies providing audit and certification of information security management systems Technologies de l'information — Techniques de sécurité — Exigences pour les organismes procédant à l'audit et à la certification des systèmes de management de la sécurité de l'information ISO/IEC 27006:2007(E) PDF disclaimer This PDF file may contain embedded typefaces. In accordance with Adobe's licensing policy, this file may be printed or viewed b ut shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editin g. In downloading this file, parties accept therein the responsibility of not infringing Adobe's licensing policy. The ISO Central Se cretariat accepts no liability in this area. Adobe is a trademark of Adobe Systems Incorporated. Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-cr eation parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bod ies. In the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below. © ISO/IEC 2007 All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by an y means, electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address be low or ISO's member body in the country of the requester. ISO copyright office Case postale 56 • CH-1211 Geneva 20 Tel. + 41 22 749 01 11 Fax + 41 22 749 09 47 E-mail [email protected] Web www.iso.org Published in Switzerland ii © ISO/IEC 2007 – All rights reserved ISO/IEC 27006:2007(E) © ISO/IEC 2007 – All rights reserved iiiContents Foreword....................................................................................................................... ..................................... iv Introduction ................................................................................................................... ..................................... v 1 Scope .......................................................................................................................... ............................1 2 Normative references ........................................................................................................... .................1 3 Terms and definitions .......................................................................................................... .................1 4 Principles..................................................................................................................... ...........................2 5 General requirements........................................................................................................... .................2 5.1 Legal and contractual matter................................................................................................... .............2 5.2 Management of impartiality ..................................................................................................... .............2 5.3 Liability and financing........................................................................................................ ...................3 6 Structural requirements ........................................................................................................ ................3 6.1 Organizational structure and top management..................................................................................3 6.2 Committee for safeguarding impartiality ...........................................................................