ISO/IEC 27006:2024

International

v2024

13 domains

33 controls

ISO/IEC 27006 specifies requirements and provides guidance for bodies providing audit and certification of information security management systems (ISMS). It supplements ISO/IEC 17021-1 with ISMS-specific requirements for certification bodies, including auditor competence, audit time, and certification scope determination.

Unverified

ISO/IEC 27006:2024 is a compliance framework from International with 13 domains and 33 controls that map to 59 other frameworks. The largest domains are Audit (7 controls), Clause 9: Audit and Certification Process Requirements (5 controls), Resources (4 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (13)

Annex A

1 controls

Controls in the Annex A domain of ISO/IEC 27006:2024 — 1 controls
Code	Title	Description
27006-A.1	Auditor Competence Areas	Demonstrate auditor competence across ISMS, risk, controls, sector and audit techniques per Annex A table.

Annex B

1 controls

Controls in the Annex B domain of ISO/IEC 27006:2024 — 1 controls
Code	Title	Description
27006-B.1	Audit Time Determination	Apply Annex B base audit time table and documented modifiers for ISMS audit duration.

Annex C-E: Audit Time and Controls

3 controls

Controls in the Annex C-E: Audit Time and Controls domain of ISO/IEC 27006:2024 — 3 controls
Code	Title	Description
27006-C	Audit time guidance	Guidance on determining audit time based on effective number of personnel concept
27006-D	Audit time calculation methods	Methods for calculating audit time including multi-site and scope extension calculations
27006-E	Controls alignment	Alignment of audit requirements with ISO/IEC 27001:2022, Annex A controls

Audit

7 controls

Controls in the Audit domain of ISO/IEC 27006:2024 — 7 controls
Code	Title	Description
27006-7.2	Audit Programme	Plan a three year ISMS audit programme covering full scope including surveillance and recertification.
27006-7.3	Stage 1 Audit	Conduct Stage 1 readiness audit covering documentation, scope and risk assessment review.
27006-7.4	Stage 2 Audit	Conduct Stage 2 implementation audit on site covering Annex A controls and management system effectiveness.
27006-7.5	Surveillance Audits	Perform annual surveillance covering changes, incidents, internal audit, and selected controls.
27006-7.6	Recertification Audit	Perform recertification audit confirming ongoing effectiveness across full ISMS scope before certificate expiry.
27006-7.7	Special Audits	Conduct short notice or extension audits when significant changes or complaints affect ISMS.
27006-7.8	Reporting	Issue audit reports including findings, nonconformities, opportunities, and certification recommendation.

Clause 5: Structural Requirements

2 controls

Controls in the Clause 5: Structural Requirements domain of ISO/IEC 27006:2024 — 2 controls
Code	Title	Description
27006-5.1	General Requirements for Certification Bodies	Certification bodies must be legal entities accountable for ISMS certification decisions and impartiality.
27006-5.2	Management of Impartiality	Identify, analyse, and treat threats to impartiality in ISMS audit and certification activities.

Clause 6: Resource Requirements

1 controls

Controls in the Clause 6: Resource Requirements domain of ISO/IEC 27006:2024 — 1 controls
Code	Title	Description
27006-6.1	Competence of personnel	Competence requirements for personnel involved in the certification process

Clause 7: Process Requirements - Competence

3 controls

Controls in the Clause 7: Process Requirements - Competence domain of ISO/IEC 27006:2024 — 3 controls
Code	Title	Description
27006-7.1	General competence requirements	General requirements for competence of various roles involved in providing a certification service
27006-7.1.2	Multi-Site Sampling	Apply documented sampling for multi-site ISMS audits including site selection rationale.
27006-7.1.3	Technical knowledge requirements	Requirements for technical knowledge of information security specific to the client organization's sector

Clause 8: Certification Documents and Information Requirements

3 controls

Controls in the Clause 8: Certification Documents and Information Requirements domain of ISO/IEC 27006:2024 — 3 controls
Code	Title	Description
27006-8.1	Certification Decision	Independent personnel make certification decisions based on audit evidence and competence review.
27006-8.2	Suspension, Withdrawal, Reduction	Apply documented criteria for suspending, withdrawing or reducing ISMS certification scope.
27006-8.2.3	Referencing other standards	Refined requirements for referencing other standards in the ISMS certification documents

Clause 9: Audit and Certification Process Requirements

5 controls

Controls in the Clause 9: Audit and Certification Process Requirements domain of ISO/IEC 27006:2024 — 5 controls
Code	Title	Description
27006-9.1	Complaints and Appeals	Operate documented process for complaints and appeals with impartial review.
27006-9.1.3.3	Remote audit provisions	New requirements for deploying remote audit techniques including documentation of extent and effectiveness
27006-9.3	Initial certification	Requirements for the initial ISMS certification audit process
27006-9.3.2.2	Certification decision process	Requirements for the certification decision-making process and criteria
27006-9.4	Surveillance and recertification	Requirements for surveillance audit activities and recertification of ISMS

Financial Stability

1 controls

Controls in the Financial Stability domain of ISO/IEC 27006:2024 — 1 controls
Code	Title	Description
27006-5.3	Liability and Financing	Demonstrate adequate finance and liability arrangements for certification operations.

Management

1 controls

Controls in the Management domain of ISO/IEC 27006:2024 — 1 controls
Code	Title	Description
27006-9.2	Management System Requirements	Operate the certification body management system covering documents, records, internal audits and review.

Process

1 controls

Controls in the Process domain of ISO/IEC 27006:2024 — 1 controls
Code	Title	Description
27006-7.1.1	Determining Audit Time	Calculate ISMS audit duration using documented method including risk and scope factors.

Resources

4 controls

Controls in the Resources domain of ISO/IEC 27006:2024 — 4 controls
Code	Title	Description
27006-6.1.1	Competence of Personnel	Define and maintain competence criteria for ISMS audit personnel and decision makers.
27006-6.1.2	Personnel Involved in Certification	Manage internal and external personnel covering ISMS audit team roles and responsibilities.
27006-6.1.3	Use of Individual External Auditors and Technical Experts	Control engagement of external auditors and technical experts including independence checks.
27006-6.2	Personnel Records	Maintain up to date records of qualifications, training, experience and performance for ISMS personnel.

Your Compliance Coverage

If you comply with ISO/IEC 27006:2024, you already cover:

ISO 13485:2016

2 controls mapped

Compare →

ISO 22301:2019

1 controls mapped

Compare →

ISO/IEC 42001:2023

1 controls mapped

Compare →

+ 56 more: ISO/IEC 17025:2017 - General Requirements for Testing and Calibration (3%), ISO 27018:2019 (3%)

See all 59 mapped frameworks ↓

Maps to 59 other frameworks

33 total controls

ISO 13485:2016

2 source controls mapped|2 target controls covered

ISO 22301:2019

1 source controls mapped|1 target controls covered

ISO/IEC 42001:2023

1 source controls mapped|1 target controls covered

ISO/IEC 17025:2017 - General Requirements for Testing and Calibration

1 source controls mapped|3 target controls covered

ISO 27018:2019

1 source controls mapped|1 target controls covered

US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule

1 source controls mapped|1 target controls covered

UAE Virtual Asset Regulatory Authority (VARA) Regulations

1 source controls mapped|1 target controls covered

TSA Pipeline Cybersecurity Directives

1 source controls mapped|1 target controls covered

TEFCA - Trusted Exchange Framework and Common Agreement

1 source controls mapped|1 target controls covered

OWASP DevSecOps Maturity Model (DSOMM)

1 source controls mapped|1 target controls covered

Oman National Cybersecurity Framework

1 source controls mapped|1 target controls covered

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security

1 source controls mapped|1 target controls covered

NIST SP 800-146

1 source controls mapped|1 target controls covered

NIST SP 800-145

1 source controls mapped|1 target controls covered

NIST SP 800-144

1 source controls mapped|1 target controls covered

New Zealand Information Security Manual (NZISM)

1 source controls mapped|1 target controls covered

NERC CIP

1 source controls mapped|1 target controls covered

NATO AQAP 2110 - Quality Assurance Requirements for Design, Development, and Production

1 source controls mapped|1 target controls covered

MTCS (Singapore)

1 source controls mapped|1 target controls covered

Japan FSA Cybersecurity Guidelines for Financial Institutions

1 source controls mapped|1 target controls covered

ISMAP (Japan)

1 source controls mapped|1 target controls covered

IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2)

1 source controls mapped|1 target controls covered

IEEE 1686

1 source controls mapped|1 target controls covered

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)

1 source controls mapped|1 target controls covered

HKMA Cyber Resilience Assessment Framework (C-RAF)

1 source controls mapped|1 target controls covered

Ghana Cybersecurity Act

1 source controls mapped|1 target controls covered

FTC GLBA Safeguards Rule (16 CFR Part 314)

1 source controls mapped|1 target controls covered

Florida Digital Bill of Rights (FDBR)

1 source controls mapped|1 target controls covered

FISMA

1 source controls mapped|1 target controls covered

FedRAMP Rev 5

1 source controls mapped|1 target controls covered

FedRAMP High

1 source controls mapped|2 target controls covered

NIST SP 800-53 Revision 5.1 HIGH

1 source controls mapped|2 target controls covered

FedRAMP Moderate

1 source controls mapped|2 target controls covered

ASD Strategies to Mitigate Cyber Security Incidents

1 source controls mapped|2 target controls covered

Belgium CyberFundamentals

1 source controls mapped|1 target controls covered

Canada Artificial Intelligence and Data Act (AIDA)

1 source controls mapped|1 target controls covered

US SEC Digital Assets and Crypto Regulatory Framework

1 source controls mapped|1 target controls covered

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity

1 source controls mapped|1 target controls covered

API 1164

1 source controls mapped|1 target controls covered

FFIEC Cybersecurity Assessment Tool (CAT)

1 source controls mapped|1 target controls covered

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements

1 source controls mapped|1 target controls covered

NIST Cybersecurity Framework 2.0

1 source controls mapped|1 target controls covered

IAIS Insurance Core Principles (ICPs)

1 source controls mapped|1 target controls covered

ISO/IEC 27400:2022

1 source controls mapped|1 target controls covered

ISO 27018

1 source controls mapped|1 target controls covered

ISO 27019

1 source controls mapped|1 target controls covered

NIST SP 800-190

1 source controls mapped|1 target controls covered

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018)

1 source controls mapped|1 target controls covered

NIST SP 1800-32

1 source controls mapped|1 target controls covered

ISO 28001:2007 Supply Chain Security Management

1 source controls mapped|1 target controls covered

ISO 27017

1 source controls mapped|1 target controls covered

South Korea ISMS-P

1 source controls mapped|1 target controls covered

BSI IT-Grundschutz

1 source controls mapped|1 target controls covered

NIST SP 800-53 Rev 5 MODERATE

1 source controls mapped|1 target controls covered

NIST SP 800-53 Rev 5 LOW

1 source controls mapped|1 target controls covered

IEC 62443

1 source controls mapped|1 target controls covered

UK Telecommunications (Security) Act 2021

1 source controls mapped|1 target controls covered

Singapore Government Instruction Manual on ICT&SS Management (IM8)

1 source controls mapped|1 target controls covered

NIST SP 800-53 Rev 5

1 source controls mapped|1 target controls covered

Compare ISO/IEC 27006:2024 with ISO 13485:2016

What is ISO/IEC 27006:2024 and who does it apply to?

ISO/IEC 27006:2024 is a compliance framework from International with 13 domains and 33 controls. ISO/IEC 27006 specifies requirements and provides guidance for bodies providing audit and certification of information security management systems (ISMS). It supplements ISO/IEC 17021-1 with ISMS-specific requirements for certification bodies, including auditor competence, audit time, and certification scope determination. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does ISO/IEC 27006:2024 actually require?

ISO/IEC 27006:2024 has 33 controls organised across 13 domains. The largest domains are Audit (7 controls), Clause 9: Audit and Certification Process Requirements (5 controls), Resources (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of ISO/IEC 27006:2024 do I already cover?

ISO/IEC 27006:2024 maps to 59 other compliance frameworks. The top mapping partners are ISO 13485:2016 (6% coverage), ISO 22301:2019 (3% coverage), ISO/IEC 42001:2023 (3% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement ISO/IEC 27006:2024?

Start your ISO/IEC 27006:2024 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ISO/IEC 27006:2024 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 33 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required