ISO & IEC / Certification-body requirements
ISO/IEC 27006-1:2024 Trust the ISMS certifier
This standard adds ISMS-specific requirements for bodies that audit and certify organizations against ISO/IEC 27001. Its purpose is to make those certification decisions competent, consistent and impartial.
The place in the system
Where it fits
It governs the certification body rather than adding requirements to the organization seeking a 27001 certificate.
Practical interpretation
How to use this reference
These are editorial starting points, not copied requirements or an implementation checklist from the standard.
Questions and actions
- Check which body issued a certificate and whether its accreditation is relevant.
- Confirm the certificate's standard edition, scope and validity.
- Separate assurance about the certifier from assurance about a supplier's actual service.
Evidence to look for
- Certificate scope record
- Certification-body accreditation reference
- Supplier assurance review
Illustrative example
What it could look like
A procurement team receives two supplier certificates that appear similar at first glance. It checks the issuing bodies and certificate scopes before deciding what additional service-specific evidence is needed.
Boundary to keep clear
An organization is certified to ISO/IEC 27001, not to ISO/IEC 27006-1; this document addresses the certifier.
Source and edition check
Open the official record
Research checked 2026-10-20. Catalogue status and edition can change; the official publisher record controls. Full standard text is not reproduced here.