If you are certified to ISO 27001:2022 the information security management system standard, or planning to be, a 2024 update to ISO 27006-1 may affect you.
Here we look at the changes and how ISO 27001 Certification Bodies may apply them.
What is ISO/IEC 27006-1:2024?
You may not have heard of ISO 27006 before. It is primarily used by certification bodies to determine the number of audit days required, auditor competence and other audit requirements for ISO 27001.
While you do not need to be aware of ISO 27006 to implement a compliant ISO 27001:2022 information security management system, our ISO 27001 Consultants at Assent Risk Management are aware of the standard so we can guide you through the certification process and ensure the best relationship with your certification body.
What has changed in ISO/IEC 27006-1:2024?
The newly revised standard has several significant changes including:
Addressing Remote ISO 27001 Audits
Since 2020 the trend has been for more remote audits to be carried out, and his updated guidance for certification bodies addresses that trend.
Remote audits may not always be appropriate, due to physical security risks that may exist, however they do provide a valuable tool in the ISO 27001 Certification process.
There an on-going project to develop a standard to explicitly address remote audits: ISO 17012, which we continue to monitor.
New ISO 27001 Audit Time Calculations
ISO 27001 Certification Bodies use ISO 27006 to determine how many audit days are required. The standard includes a table based on staff numbers, however there are certain discounts that can be applied.
Annex C now breaks out the audit time calculations in more detail providing sub annexes for surveillance, recertification, multi-site and extension to scope audits.
It should also be noted that multi-site guidance is provided by the International Accreditation forum under: IAF MD for certification of multi-site organisations (who do not meet the IAF MD1 eligibility criteria for sampling)
Annex E, Guidance for Review of Implementation Changes
Specifically used by ISO 27001 Auditors, Annex E, Guidance for Review of Implementation Changes, has aligned to the updated ISO 27001:2022 control set.
In addition, Clause 9.1.1.2, suggests that an organisation can achieve ISO 27001 compliance, even where NO ISO 27001:2022 Annex A controls are adopted, if the organisation has designed controls or identifies them from another source.
In reality this is unlikely to happen as the standard provides 93 controls covering Organisational, People, Physical and Technological controls which are commonly applied.
Changes to ISO 27001 Auditor Competence and Experience
Again, this change is not directly relevant to clients, however the standard has also removed the quantitative experience and training requirement for ISMS Auditors.
What Does ISO/IEC 27006-1:2024 Mean for Clients?
Clients and organisation who have implemented ISO 27001:2022 do not necessarily need to be familiar with the requirements of ISO 27006, however it can be useful to have an awareness of how the certification body may approach the audit.
Engaging an ISO 27001 Consultant such as Assent Risk Management is a good way to ensure you define the scope of your ISMS effectively and make the correct application to your chosen Certification Body to avoid delays.
What Does ISO/IEC 27006-1:2024 Mean for Individual Auditors?
Existing ISO 27001 Auditors would benefit from familarising themselves with the requirements of ISO 27006:2024 as this will inform how they conduct ISMS audits on behalf of a certification body.
For those considering a career as an ISO 27001 Auditor, pay particular attention to the competence and experience requirements of the standard.
Contact the ‘Careers In Standards’ project for support entering the certification industry.
What Does ISO/IEC 27006-1:2024 Mean for Certification Bodies?
Accredited certification bodies will be required to operate to the updated ISO 27006:2024 when determining ISO 27001 audit time and generally conducting audits.
National accreditation bodies will issue their own bulletins, however as an example, UKAS issued the following on 7th March 2024: ISO/IEC 27006-1:2024 ISMS transition arrangements.
This includes a requirement to submit a Gap Analysis to the new standard by 30th April 2024.
Other key Dates:
- 01 March 2024. Publication of ISO/IEC 27006-1:2024
- 01 May 2024. UKAS ready to assess to ISO/IEC 27006-1:2024
- 31 July 2025. All UKAS transitions of Certification Bodies completed.
