Iso 27006 — [best]

ISO/IEC 27006 does not exist in a vacuum. It is built upon the generic standard for management system certification, (Conformity assessment — Requirements for bodies providing audit and certification of management systems). ISO/IEC 27006 takes the general requirements of 17021-1 and tailors them specifically for the discipline of Information Security.

Unlike other management system standards (like ISO 9001 Quality), information security audits involve exposure to highly sensitive data (network diagrams, vulnerability reports, trade secrets). iso 27006