National foreword

This Published Document is the UK implementation of ISO/IEC TR 20000‑7:2019.

The UK participation in its preparation was entrusted to Technical Committee IST/60/2, IT Service Management.

A list of organizations represented on this committee can be obtained on request to its secretary.

This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application.

Compliance with a British Standard cannot confer immunity from legal obligations.

This Published Document was published under the authority of the Standards Policy and Strategy Committee on 31 July 2019.

Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of ISO documents should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of any patent rights identified during the development of the document will be in the Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents).

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO's adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.

This document was prepared by Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 40, IT Service Management and IT Governance.

A list of all parts in the ISO/IEC 20000 series can be found on the ISO website.

Any feedback or questions on this document should be directed to the user’s national standards body. A complete listing of these bodies can be found at www.iso.org/members.html.

Introduction

This document provides guidance on the integration of ISO/IEC 20000‑1:2018, ISO 9001:2015 and ISO/IEC 27001:2013. All three standards use the clause structure, common terms and common requirements from the high level structure (HLS) of management system standards (MSS) specified in the ISO/IEC Directives, Part 1. The adoption of the HLS enables an organization to align or integrate multiple management system standards. For example, a service management system (SMS) can be integrated with a quality management system based on ISO 9001 or an information security management system based on ISO/IEC 27001. The relationship between these three standards is very close; therefore, many organizations may already recognise the benefits of adopting two or all three of them.

Benefits of an integrated implementation of management systems can be:

less effort and lower cost for the organization to implement the integrated management system and less ongoing effort required to keep it updated;
increased credibility to external parties of the organization having a single integrated management system;
more effective internal processes and improved communication in the organization by streamlining the interaction between the service, quality, and information security management aspects of their management system.

Apart from the common terms, requirements and the HLS, there are other commonalities in these three standards that provide an opportunity for integration. On the other hand, there are also differences that need to be kept in mind when integrating these management systems.

It is assumed that users of this document have access to and a basic understanding of the ISO/IEC 20000‑1, ISO 9001, and ISO/IEC 27001 standards. The content of these standards is not repeated nor fully explained in this document.

NOTE The high level structure (HLS) of management system standards (MSS) specified in the ISO/IEC Directives, Part 1, Annex L, is referred to in this document as either "HLS" or "HLS of MSS". The high level structure was formerly contained in the ISO/IEC Directives, Part 1, Annex SL. In this document, the term "Annex SL" is used only when making a direct citation to a standard that was published when the Annex SL was still in place, e.g. ISO 9001:2015, ISO/IEC 20000-1:2018, ISO/IEC 27001:2013.

1 Scope

This document provides guidance on the integrated implementation of a service management system (SMS) as specified in ISO/IEC 20000‑1 with a quality management system (QMS) as specified in ISO 9001 and an information security management system (ISMS) as specified in ISO/IEC 27001. It is aimed at those organizations that are intending to either:

implement ISO 9001 when ISO/IEC 20000‑1 is already implemented, or vice versa;
implement ISO/IEC 27001 when ISO/IEC 20000‑1 is already implemented, or vice versa;
implement both ISO 9001 and ISO/IEC 20000‑1 together, or implement both ISO/IEC 27001 and ISO/IEC 20000‑1 together;
implement ISO/IEC 20000‑1, ISO 9001 and ISO/IEC 27001 together; or
integrate existing management systems based on ISO/IEC 20000‑1, ISO 9001 and ISO/IEC 27001.

In practice, an SMS, QMS or ISMS can also be integrated with other management system standards (MSS), such as ISO 22301 or ISO 55001.

Clause 4 provides an introduction to ISO/IEC 20000‑1, the HLS of MSS specified in ISO/IEC Directives Part 1 and considerations for the integration of an MSS.

Clause 5 provides an introduction to ISO 9001, commonalities and differences with ISO/IEC 20000‑1 and considerations for the integration of an SMS with a QMS.

Clause 6 provides an introduction to ISO/IEC 27001, commonalities and differences with ISO/IEC 20000‑1 and considerations for the integration of an SMS with an ISMS.

Clause 7 looks at considerations for the integration of an SMS, a QMS, and an ISMS.

This document also provides correlation information for the terms and definitions of ISO/IEC 20000‑1 with ISO 9001 and ISO/IEC 27001 in Annex A. Correlation of the clauses of ISO/IEC 20000‑1 with ISO 9001 is shown in Annex B. Correlation of the clauses of ISO/IEC 20000‑1 with ISO/IEC 27001 is shown in Annex C.

2 Normative references

3 Terms and definitions

4 Integration of ISO/IEC 20000‑1:2018 with other management system standards (MSS)

4.1 Introduction to ISO/IEC 20000‑1:2018

4.2 ISO/IEC Directives, Part 1, high level structure (HLS) for management system standards (MSS) common requirements

4.3 Service management specific requirements

4.4 Considerations for the integration of management system standards (MSS)

5 Integration of ISO/IEC 20000‑1:2018 with ISO 9001:2015

5.1 Introduction to ISO 9001:2015

5.2 Similarities and differences in requirements between ISO/IEC 20000‑1:2018 and ISO 9001:2015

5.3 Quality management specific requirements

5.4 Considerations for the integration of an SMS and a QMS

6 Integration of ISO/IEC 20000‑1:2018 with ISO/IEC 27001:2013

6.1 Introduction to ISO/IEC 27001:2013

6.2 Similarities and differences in requirements between ISO/IEC 20000‑1:2018 and ISO/IEC 27001:2013

6.3 Information security management specific requirements

6.4 Considerations for the integration of an SMS and an ISMS

7 Integration of ISO/IEC 20000‑1:2018, ISO 9001:2015 and ISO/IEC 27001:2013

7.1 Similarities and differences in requirements between ISO/IEC 20000‑1:2018, ISO 9001:2015 and ISO/IEC 27001:2013

7.2 Considerations for the integration of an SMS, a QMS and an ISMS

Bibliography

PD ISO/IEC TR 20000-7:2019

Information technology. Service management - Guidance on the integration and correlation of ISO/IEC 20000-1:2018 to ISO 9001:2015 and ISO/IEC 27001:2013

Current

Published:

31 Jul 2019