IAF MD 29 – Transition to ISO/IEC 27006:2024

IAF MD 29 is the most recent IAF publication with implications for certification services in the field of information security to ISO/IEC 27001.

Background: ISO 27006

ISO/IEC 27006:2024 is the central standard defining requirements for bodies that audit and certify information security management systems. Accreditations – such as ours – are granted exclusively in conjunction with the requirements of DIN EN ISO/IEC 27006.

DIN EN ISO/IEC 27006 defines in particular:

General requirements (e.g. legal and contractual matters)
Requirements for resources (e.g. the competencies of auditors)
Requirements for information (e.g. confidentiality)
Requirements for processes (e.g. audit planning, certification decisions)
Management system requirements for certification bodies

In addition, corresponding requirements are defined, for example regarding the calculation of audit time, which must be complied with.

IAF MD 29 and DIN EN ISO/IEC 27006

IAF MD 29 now defines requirements for accredited certification bodies as well as for the accreditation bodies (such as DAkkS) governing the changeover from DIN EN ISO/IEC 27006:2021 to ISO/IEC 27006:2024. ISO/IEC 27006:2024 was published in spring 2024. IAF MD 29 defines a transition period of two years, within which all accredited certification bodies must be transitioned to ISO/IEC 27006:2024 by their respective accreditation authority.

What the transition means

The transition to ISO/IEC 27006:2024 initially has no direct effects on certified organisations, as the standard defines requirements for certification and accreditation bodies. Certification bodies must analyse the changes arising from ISO/IEC 27006:2024 and implement them internally. In our case, the compliant implementation of these changes is audited by DAkkS and, if successful, confirmed. Without a transition to ISO/IEC 27006:2024, we would lose our accreditation status at the end of the transition period.

The transition process

The process for such a transition to a new version of a standard is as follows:

Submission of an application for change to DAkkS for the changeover to ISO/IEC 27006:2024; analysis of the changes (gap analysis) between ISO/IEC 27006:2024 and the previous version of the standard.
Transition plan with specific deadlines.
Evidence of the changes to documents made necessary by the transition.
Technical assessment by a DAkkS auditor, generally by means of a document review.
Where applicable, an on-site assessment by DAkkS auditors at our offices, if the documentation submitted is not sufficient to demonstrate the transition successfully.
If the DAkkS assessment is successful, the results are presented to the accreditation committee, which decides on accreditation.
If the decision is positive, the accreditation certificate is amended. From that point onwards, audits to ISO/IEC 27001 in conjunction with ISO/IEC 27006:2024 may be carried out.

This entry does not claim to cover all individual requirements of IAF MD 29 in full. Rather, it is intended as a summary of the key requirements – particularly from a customer perspective.

Go back

IAF MD 11 – Audits of integrated management systems to ISO/IEC 17021-1

How can organisations with several management systems – for example for quality and information security – make their audit processes more efficient? The IAF MD 11:2023 guidance provides answers to the key questions on auditing integrated management systems. In our article you will learn exactly what the "degree of integration" is, how it affects audit time, and why a high level of integration can save real money. We show you which requirements conformity assessment bodies must meet, how the audit effort is calculated, and give a concrete worked example for practice. A must for anyone looking to optimise audits and avoid unnecessary duplicate assessments.

IAF MD 1 – Auditing and certification of management systems in multi-site organisations

How does certification work for organisations with multiple sites – and what needs to be considered in multi-site audits? The IAF MD 1:2023 guidance sets out clear requirements, which we examine more closely in this article. From the definition of key terms such as "head office" and "sites", through the requirements for matrix certifications, to the question of when a sampling procedure makes sense and when it does not: we provide a comprehensive overview of the factors that influence audit effort and audit duration. Discover the key prerequisites and find out how best to prepare the certification process for your multi-site organisation. An indispensable guide for organisations looking to structure their certification effort clearly.

IAF MD 2 – Certificate transfers

Would you like to transfer your certification to a new certification body? The IAF MD 2 document governs the prerequisites and requirements to be met when transferring certificates – for example for ISO 9001 or ISO/IEC 27001. In this article you will learn under which conditions a certificate transfer is possible, how the assessment process works, and what to do if certificates cannot be transferred due to particular circumstances. We also examine the role of the issuing and the accepting certification body in the transfer process and what to bear in mind after a successful transfer. An indispensable guide for organisations aiming for a smooth change of certificate.

IAF MD 4 – Use of information and communication technology (ICT) in audits

Digital technologies in audits – yes or no? IAF MD 4:2023 sets out clear rules on how information and communication technology (ICT) can be used for audit purposes and when remote delivery is possible. This article gives you an overview of the fundamental requirements a certification body must meet when audits are carried out using ICT. Find out how virtual sites are defined, which conditions apply to the use of ICT, and how factors such as security, confidentiality and procedural requirements are taken into account. A must for organisations considering ICT for more efficient audits.

IAF MD 26 – Transition from DIN EN ISO/IEC 27001:2017 to ISO/IEC 27001:2022

The transition to the new ISO/IEC 27001:2022 is unavoidable for certified organisations. The IAF MD 26:2023 document defines clear requirements and deadlines to ensure the transition from DIN EN ISO/IEC 27001:2017 to the new standard. Certified organisations have a transition period until 31 October 2025 to maintain their certification. This article summarises the key points of the transition – from the requirements for updating the ISMS and the Statement of Applicability through to the minimum effort involved in the audit. An essential guide for anyone looking to master the changeover successfully.