ISO/IEC TS 27006-2:2021 PDF

Requirements for bodies providing audit and certification of information security management systems — Part 2: Privacy information management systems

Название (английский):

ISO/IEC TS 27006-2:2021

Requirements for bodies providing audit and certification of information security management systems — Part 2: Privacy information management systems

Статус документа:: Отменён
Формат:: Электронный (PDF)
Количество страниц:: 9
Дата публикации:: 26 февраля 2021 г.
Издание:: ISO/IEC TS 27006 edition 1 version 1
ICS:: 03.120.20

Тип поставки:

Full version135 €Read online 24h10 €Read online 72h15 €

Язык документа:

ruen

Срок поставки:2 раб. дн. (перевод)

Цена:135 €

Описание (английский):

This document specifies requirements and provides guidance for bodies providing audit and certification of a privacy information management system (PIMS) according to ISO/IEC 27701 in combination with ISO/IEC 27001, in addition to the requirements contained within ISO/IEC 27006 and ISO/IEC 27701. It is primarily intended to support the accreditation of certification bodies providing PIMS certification. The requirements contained in this document need to be demonstrated in terms of competence and reliability by anybody providing PIMS certification, and the guidance contained in this document provides additional interpretation of these requirements for any body providing PIMS certification. NOTE This document can be used as a criteria document for accreditation, peer assessment or other audit processes.

Технические детали

Технический комитет: ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
SKU: ISO/IEC TS 27006-2:2021

Abstract

Overview

ISO/IEC TS 27006-2:2021 is a Technical Specification that defines additional requirements and guidance for bodies auditing and certifying Privacy Information Management Systems (PIMS) implemented to ISO/IEC 27701 together with ISO/IEC 27001. Published in 2021, it supplements ISO/IEC 27006 by specifying PIMS‑specific competence, process and information requirements. The document is primarily intended to support accreditation bodies and to harmonize assessment of certification bodies offering PIMS certification.

Key topics and requirements

This TS follows the structure of ISO/IEC 27006 and identifies PIMS-specific elements (prefixed “PS”). Major topics include:

Scope and normative basis - Clarifies that ISO/IEC 27006 and ISO/IEC 27701 apply alongside this TS.
Legal and contractual matters - Requirements for agreements, normative references and contractual clarity.
Management of impartiality - Conflict of interest rules; notably certification bodies shall not provide PIMS consultancy (e.g., acting as external DPO or performing data protection reviews).
Structural and resource requirements - Organizational arrangements for reliable PIMS certification.
Competence of personnel - Determination of competence criteria, auditor knowledge/experience, selection and use of external auditors and technical experts.
Information requirements - Public information, certification documentation, confidentiality and exchange of client information.
Process requirements - Pre‑certification, application review, audit planning (time, multi‑site sampling, multi‑system audits), conducting audits (initial, surveillance, re‑certification, special audits), certification decisions, appeals and complaints.
Management system requirements for certification bodies - Options for implementing a management system (including alignment with ISO 9001).

Practical applications and users

ISO/IEC TS 27006-2 is used to:

Guide accreditation bodies assessing certification bodies for PIMS accreditation.
Define demonstrable competence and impartiality criteria for certification bodies offering ISO/IEC 27701 certification.
Support audit teams (lead auditors, technical experts) in planning and conducting PIMS audits consistent with ISO/IEC 27001 controls and privacy extensions.
Serve as a criteria document for peer assessments or other audit processes. Benefits include harmonized accreditation decisions, clearer competence requirements for auditors, and strengthened confidence in certified PIMS.

Related standards

ISO/IEC 27006 (requirements for ISMS certification bodies)
ISO/IEC 27701 (PIMS extension to ISO/IEC 27001/27002)
ISO/IEC 27001 (information security management)
ISO/IEC 17021-1 (management system certification bodies)
ISO/IEC 27000, ISO/IEC 29100

Keywords: ISO/IEC TS 27006-2, PIMS certification, ISO/IEC 27701, certification bodies, accreditation, privacy information management systems, audit requirements.

Overview

Key topics and requirements

This TS follows the structure of ISO/IEC 27006 and identifies PIMS-specific elements (prefixed “PS”). Major topics include:

Scope and normative basis - Clarifies that ISO/IEC 27006 and ISO/IEC 27701 apply alongside this TS.
Legal and contractual matters - Requirements for agreements, normative references and contractual clarity.
Management of impartiality - Conflict of interest rules; notably certification bodies shall not provide PIMS consultancy (e.g., acting as external DPO or performing data protection reviews).
Structural and resource requirements - Organizational arrangements for reliable PIMS certification.
Competence of personnel - Determination of competence criteria, auditor knowledge/experience, selection and use of external auditors and technical experts.
Information requirements - Public information, certification documentation, confidentiality and exchange of client information.
Process requirements - Pre‑certification, application review, audit planning (time, multi‑site sampling, multi‑system audits), conducting audits (initial, surveillance, re‑certification, special audits), certification decisions, appeals and complaints.
Management system requirements for certification bodies - Options for implementing a management system (including alignment with ISO 9001).

Practical applications and users

ISO/IEC TS 27006-2 is used to:

Guide accreditation bodies assessing certification bodies for PIMS accreditation.
Define demonstrable competence and impartiality criteria for certification bodies offering ISO/IEC 27701 certification.
Support audit teams (lead auditors, technical experts) in planning and conducting PIMS audits consistent with ISO/IEC 27001 controls and privacy extensions.
Serve as a criteria document for peer assessments or other audit processes. Benefits include harmonized accreditation decisions, clearer competence requirements for auditors, and strengthened confidence in certified PIMS.

Related standards

ISO/IEC 27006 (requirements for ISMS certification bodies)
ISO/IEC 27701 (PIMS extension to ISO/IEC 27001/27002)
ISO/IEC 27001 (information security management)
ISO/IEC 17021-1 (management system certification bodies)
ISO/IEC 27000, ISO/IEC 29100

Keywords: ISO/IEC TS 27006-2, PIMS certification, ISO/IEC 27701, certification bodies, accreditation, privacy information management systems, audit requirements.

ISO/IEC TS 27006-2:2021 PDF

Технические детали

Abstract

Overview

Key topics and requirements

Practical applications and users

Related standards

Похожие стандарты

Abstract

Overview

Key topics and requirements

Practical applications and users

Related standards

Похожие стандарты

Information security, cybersecurity and privacy protection - Privacy information management systems - Require…

Information security, cybersecurity and privacy protection — Information security management systems — Requir…

Information security, cybersecurity and privacy protection. Requirements for bodies providing audit and certi…

Quality management systems — Specific requirements for the application of ISO 9001:2015 by organizations in t…

Conformity assessment. Requirements for bodies providing audit and certification of management systems. Compe…

Information technology. Security techniques. Information security management systems. Overview and vocabulary

Information technology - Security techniques - Privacy framework (ISO/IEC 29100:2011, including Amd 1:2018)