Notice on the implementation of the information security management system certification proces
Information on the transition to ISO/IEC 27006-1:2024
We would like to inform all interested parties that the International Organization for Standardization (ISO) published the ISO/IEC 27006-1:2024 standard on March 1, 2024, which replaced the previous ISO/IEC 27006:2015 standard on July 31, 2024.The previous standard and its accompanying amendments have been withdrawn but remain valid until the end of the transition period.
Given that ICS d.o.o. is an accredited certification body, all information security management system (ISMS) certification activities must be fully compliant with the requirements of the ISO/IEC 27006-1:2024 standard.
Impact of changes on certified organizations:
The application of the certification process in accordance with ISO/IEC 27006-1:2024 may result in the following for certified organizations:Changes in audit duration;
The need to amend the certificate in cases where the organization does not conduct activities at a defined physical location.
Note: These aspects will be regulated by a contract or its annex.
Key changes that may apply to your organization:
Audit procedures:
Remote audits will be clearly documented in the audit report (9.4.3.2) – applicable if remote audits are used.
If the organization does not have a physical location, the report and certificate will state that activities are performed remotely (8.2.2) – applicable for online-only clients.
Calculation of audit time:
New concept for identical activities (C.2.1) – applicable if such an employee structure exists.
The definition of the initial number of people is calculated in accordance with C.3.4.
Scope extensions and multi-site organizations:
Specific requirements for scope extensions (C.7) – applicable if certification extension is requested.
Clarifications for multi-site organizations (C.6) – applicable for multi-site clients.
Contractual updates:
Certification contracts will be adjusted to reflect the new requirements of the standard.
Your obligations:
Please plan a timely transition to the new version of the standard to ensure the continuous validity of your ISO/IEC 27001 certificate.
Transition period:
On May 21, 2024, the International Accreditation Forum (IAF) published the document IAF MD 29:2024 – Transition Requirements for ISO/IEC 27006-1:2024, which defines the deadlines and requirements for the transition process for certification and accreditation bodies.
ICS d.o.o. has established deadlines for implementing certification for its clients in accordance with ISO/IEC 27006-1:2024. The ultimate deadline for the transition of all clients to certification according to this standard is March 31, 2026.
Surveillance audits and recertifications:
Starting April 1, 2025, ICS d.o.o. will conduct all surveillance audits and recertifications in accordance with ISO/IEC 27006-1:2024. If the transition process to the new standard is not completed by the specified date, surveillance audits and recertifications will temporarily be conducted according to the previous standards (ISO/IEC 27006:2017 and ISO/IEC 27006:2015/Amd.1:2020).
Upon obtaining accreditation according to ISO/IEC 27006-1:2024, ICS will, as necessary, issue certificates with the accreditation symbol in accordance with the new standard.
Initial certifications:
Initial certifications will be carried out according to the previous standards no later than March 31, 2025. From April 1, 2025, following accreditation according to ISO/IEC 27006-1:2024, all initial ICS certifications will be conducted exclusively according to this standard.
