ISO/IEC 27006-1:2024 — ISMS certification bodies
Un certificat ISO 27001 ne vaut que ce que vaut l'organisme qui l'a délivré. L'ISO/CEI 27006-1 fixe ce qu'on exige de lui : compétence des auditeurs sur la sécurité de l'information, impartialité, confidentialité des informations recueillies pendant l'audit — sujet particulièrement sensible quand on inspecte les défenses d'une entreprise — et durée d'audit calculée sur des critères objectifs plutôt que sur ce que le client accepte de payer. La grille couvre le processus de certification complet, de la revue de candidature aux audits de surveillance. Elle s'adresse aux organismes de certification et aux instances d'accréditation qui les évaluent.
- control points
- 41
- anchored clauses
- 18
- Clauses covered
- 6
Clauses covered
| General requirements | 3 | 5.1 · 5.2.2 · 5.3 |
| Structural requirements | 1 | 6 |
| Resource and competence requirements | 4 | 7.1.2 · 7.1.3 · 7.2.2 · 7.3-7.5 |
| Information and confidentiality | 3 | 8.3 · 8.4 · 8.1-8.2 |
| Certification process | 6 | 9.1 · 9.2 · 9.5 · 9.6 · 9.3-9.4 · 9.7-9.9 |
| Management system of the body | 1 | 10 |
Scale
This template is used inside the platform: every finding becomes a corrective action tracked through to its evidence — something a printed grid cannot do.
Use this template14-day trial, no credit card. The template opens in your workspace.
How this grid is built
Every control point is written in our own words, then tied to the standard's clause number. The normative text is never reproduced: the standard itself remains to be purchased from the body that publishes it. Grids are reviewed at every new edition of a standard.
Published by NormePulse — HEMC, management consulting firmUpdated