ISO 9001 and ISO/IEC 27001 together: quality and information security in one system: video

When clients ask for consistent delivery and protected data

Service companies, software houses and BPOs are increasingly asked for both standards: ISO 9001 for consistent delivery and ISO/IEC 27001 for the security of client information. The combination is especially common in IT services, SaaS, BPO and outsourcing, where clients want to know that work is delivered as agreed and that their data is protected while it is.

Both standards follow the harmonised structure, so one management system can carry both, with one policy framework, one risk method, one internal audit and one management review. This short film walks through how that combined system is built.

Quality and security questions from clients can then be answered from the same processes and records.

Both standards share the harmonised structure, so context, leadership, planning, document control, internal audit and management review are built once and serve both systems, while each standard's specific requirements, from customer requirements and operational control in ISO 9001 to the information security risk assessment and Statement of Applicability in ISO/IEC 27001, are still met in full.

One core, with information security risk treatment on top

Each requirement is mapped once and sorted into shared and standard-specific work. The shared core covers policy, objectives, documented information, competence, internal audit and management review. Business, quality and information security risks are assessed in one framework, and ISO/IEC 27001's specific information security risk assessment and treatment process, with its Statement of Applicability, sits on top of the common risk method.

In daily operation, service quality and information security controls live in the same processes and records, so the quality and security questions clients send can be answered from one evidence base. The certification body can plan one integrated certification audit, with each finding traced to its standard, and whether certificates are issued together or separately depends on the body.

Delivery follows Sterling OS™, at the Design™ or Drive™ level, with one consultant leading both standards and the evidence held in a shared Effivity workspace for one agreed fee. The certificates themselves come from the accredited certification body.