Accreditation for Information Security Management Systems

  • Home
  • Accreditation for Information Security Management Systems

Information Security Management Systems (ISMS)

Accreditation for Information Security Management Systems (ISMS)

Information Security Management System certification confirms that an organization has established controls and a management framework for confidentiality, integrity and availability of information assets.
A certification body applying to MBAS for accreditation under this scheme shall demonstrate conformity to ISO/IEC 17021-1 and ISO/IEC 27006, MBAS accreditation procedures, applicable IAF mandatory documents and relevant statutory/regulatory requirements.
  • Application documents normally required

  • Accreditation application form for Information Security Management Systems (ISMS).
  • General accreditation requirements and conditions for accreditation.
  • Rules and conditions for use of the MBAS accreditation symbol and accreditation claim.
  • Scheme-specific accreditation requirements for ISO/IEC 27001.
  • Applicable fee schedule and quotation acceptance.
  • Documentation checklist covering ISO/IEC 17021-1 and relevant scheme-specific requirements.
  • Key evaluation areas

  • Legal identity and responsibility for certification decisions.
  • Impartiality structure, conflict-of-interest controls and committee oversight.
  • Competence criteria for auditors, technical experts, reviewers and decision makers.
  • Audit programme management, audit duration, sampling and multi-site rules where applicable.
  • Certification decision process, certificate control, surveillance, recertification and scope extension.
  • Complaints, appeals, suspension, withdrawal and public information control.