Important information regarding the approach of the BSA Agency for the transition to ISO/IEC 27006-1:2024 Information security, cybersecurity and privacy protection

Important information regarding the approach of the BSA Agency for the transition to ISO/IEC 27006-1:2024 Information security, cybersecurity and privacy protection — Requirements for bodies providing audit and certification of information security management systems — Part 1: General, which cancels and replaces ISO/IEC 27006:2015/Amd 1:2020. 1. Introduction The new version of the standard ISO/IEC 27006-1:2024 Information security, cybersecurity and privacy protection — Requirements for bodies providing audit and certification of information security management systems — Part 1: General, which cancels and replaces ISO/IEC 27006:2015/Amd 1:2020, was published on the website of the International Organization for Standardization (ISO) in March 2024. The standard was published by BIS as BDS EN ISO/IEC 27006-1:2024. It cancels and replaces BDS EN ISO/IEC 27006:2021. According to IAF MD 29:2024, the transition period of ISO/IEC 27006-1:2024 is 24 months from the date of publication of the standard. Certification bodies are required to implement the changes in their management systems and processes and demonstrate their compliance with the accreditation requirements within the deadlines specified by IAF. With this information, the BSA Agency presents an approach for assessing changes that it will use to enable each certification body performing certification of Information Security Management Systems (ISMS) to demonstrate its compliance with the requirements of the changes in BDS EN ISO/IEC 27006-1:2024 within the deadline specified by IAF. 2. Approach of the BSA EA for the assessment of the implementation of the requirements of BDS EN ISO/IEC 27006-1:2024. 2.1 General The schedule for the activities for the transition by the BSA EA and the Certification Bodies performing certification of the FSMS according to the prescriptions presented in IAF MD 29:2024 are as follows: Actions Date BSA EA BSA EA is preparing to conduct an assessment according to BDS EN ISO/IEC 27006-1:2024 Deadline for starting the assessment according to BDS EN ISO/IEC 27006-1:2024 - 01.12.2024. EA BSA will perform assessment according to BDS EN ISO/IEC 27006-1:2024 for all initial accreditations, expansion of the scope of accreditation for ISMS no later than 31.03.2025 EA BSA will perform transition of all accredited ISMS for ISMS according to BDS EN ISO/IEC 27006-1:2024 no later than 31.03.2026 Certification Bodies (CBs) of the ISMS CBs of the ISMS shall apply BDS EN ISO/IEC 27006-1:2024 for all initial and recertification audits after accreditation and in accordance with the requirements of BDS EN ISO/IEC 27006-1:2024 The date shall be determined for each CB based on the date of accreditation after successful transition CB to apply BDS EN ISO/IEC 27006-1:2024 for all clients No later than 31.03.2026 2.2 Submission of an Action Plan for the implementation of changes to BDS EN ISO/IEC 27006-1:2024 by the Certification Bodies Certification Bodies are required to submit a Gap Analysis and a Transition Action Plan at least two months prior to their assessment, as planned in the latest assessment report BAS QF 2.9.5.4 (17021-1)_Sek F. This information will be used to plan the change assessment. The action plan should demonstrate that the certification body: - has analyzed and understood the changes in the requirements of the new and old versions of the standard. Typical processes considered for change may include sales/quotation, audit process, certification document, competence management, and communication with existing certified clients. - has analyzed the impact of the changes on the relevant activities/processes and identified the necessary actions to ensure compliance (e.g. changes to the documented management system, IT tools, the certification process, etc.); - has determined the requirements for the competence of the personnel, trainings are planned and carried out, etc.; - has determined and taken the actions to assess the effective implementation of all changes so as to comply with the requirements of BDS EN ISO/IEC 17021-1:2015 and BDS EN ISO/IEC 27006-1:2024 (conducting internal audits, management review, etc.). The plan must contain a schedule and deadlines for carrying out the actions, consistent with the planned surveillance assessments, reaccreditation, extraordinary assessments and responsible persons. The plan must ensure that the relevant personnel affected by the changes are competent for the revised version of the standard and the transition process. The personnel may include, but are not limited to, auditors performing a review of audit reports, certification decision makers, application reviewers and audit planning As the audit timing requirements have changed in the 2024 revision of ISO/IEC 27006-1, the contract between CABs and their existing certified clients may need to be revised 2.3 The change assessment process will include the following assessment stages: Assessment of the Analysis of Changes and Transition Action Plan When planning and preparing an office assessment of the OSSU, the Lead Assessor assigned to conduct the office assessment will review the Analysis of Changes and Transition Action Plan and the relevant documentation and documented evidence for the implementation of the new requirements. Office assessment; EA BSA will conduct an assessment of changes during an on-site assessment during a planned assessment (surveillance or re-accreditation), following the procedure of the Accreditation Procedure (BAS QR 2) and the Instruction for determining the duration of the on-site assessment. Influencing factors (BAS QI 2), providing additional time for assessment of the actions taken (1 man-day). At the request of a certification body, if possible by the BSA Agency and if necessary to comply with the specified transition timeframes, extraordinary assessments will be conducted to establish compliance with the changes introduced by BDS EN ISO/IEC 27006-1:2024. Reissuance of accreditation certificates After establishing, through a transition assessment, that the accredited OSSMs for the scope of certification of the ISMS comply with the accreditation requirements (BDS EN ISO/IEC 17021-1:2015, BDS EN ISO/IEC 27006-1:2024), the BSA Agency will reissue the accreditation certificates with reference to the requirements of BDS EN ISO/IEC 27006-1:2024 with a validity period according to the current accreditation certificate. The certificates will be reissued only after the management system of the OSSU for the scope of certification of the ISMS is brought into compliance with the requirements of BDS EN ISO/IEC 17021-1:2015, BDS EN ISO/IEC 27006-1:2024 and in case of closed non-conformities identified during the transition assessment, in accordance with item 4.3.5.2 of the BAS QR 2 Accreditation Procedure. If before the end of the transition period, the OSSU has not demonstrated compliance with the requirements for the scope of certification of the ISMS, according to the accreditation requirements under BDS EN ISO/IEC 27006-1:2024, the agency will find non-fulfillment of the requirements and after the end of the transition period (31.03.2026), it will revoke the accreditation granted to the OSSU for the scope of certification of the ISMS.