Certification centres for management systems in the energy industry: Principles, normative specifications, DAkkS specifications, formalita using the example of ISO 27001

摘要

The IT security law forced the energy industry to implement system certifications for the first time in history. In contrast to most companies in the energy industry, which often only knew about product certifications, the energy industry now has to enter new territory. Certification companies receive their legitimation in Germany through DAkkS. The DAkkS is embedded in the context of European Union law. The work of the certification companies is determined by the specifications of the DAkkS as well as by the requirements of the ISO/IEC standards. These regulations should in any case be known to a certification customer so that he knows what a certification company does or does not do. In addition, a certification customer must also know which evidence must be presented in the sense of a reference standard against the certification company. The concrete evidence in this essay is based on an ISO/IEC 27001 certification in conjunction with the IT Security Catalog of the Bundesnetzagentur. With all this knowledge, the cooperation with the certification company will not be a problem for system certification.