ISO/IEC 20000-1 guide
ISO 20000-1 and ISO 27001: running IT service management and information security as one system
How ISO/IEC 20000-1 and ISO/IEC 27001 share clauses 4 to 10, where clause 8.7.3 meets Annex A, what stays specific to each, and how one risk method, one internal audit and a combined certification audit work in practice.
Key points
- Yes, ISO/IEC 20000-1 and ISO/IEC 27001 can run as one management system: both are written on ISO's harmonised structure, and the introduction to ISO/IEC 20000-1 names integration with an ISO/IEC 27001 system as intended.
- Clause 8.7.3 of ISO/IEC 20000-1 already asks for a security policy, risk-based controls and incident management: the ground an ISMS covers.
- Each keeps its own core: the SMS owns the catalogue, service levels, change and service reporting; the ISMS owns the risk method, Annex A and the Statement of Applicability.
- One risk method, one document set, one internal audit programme and one management review serve both, and a certification body accredited for both standards can plan a combined audit.
Why run ISO/IEC 20000-1 and ISO/IEC 27001 together?
Because the customers who ask for one usually ask for the other. An outsourcing contract or IT tender wants proof that service levels are met and that client data is protected. ISO/IEC 20000-1 answers the first, ISO/IEC 27001 the second, and both are delivered by the same service desk, change board and suppliers.
Two systems mean two policies that drift apart and two supplier reviews of the same data centre. One system means each service process is designed once, with its security obligations inside it. ISO/IEC 27013:2021 gives guidance for this: adding one standard to the other, implementing both together, or merging two existing systems.
What stays specific to each standard
Service management: agreed services, delivered and reported
ISO/IEC 20000-1 is about the service lifecycle, and its own content sits mainly in clause 8: catalogue, asset and configuration management; service levels and suppliers; demand and capacity; change, release and deployment; incidents, requests and problems; availability, continuity and security. Accredited certificates under it are normally confined to IT services, so confirm the scope with the certification body.
Information security: assessed risks and chosen controls
ISO/IEC 27001 turns on the risk method in clauses 6.1.2 and 6.1.3 and its operation in clauses 8.2 and 8.3: risks assessed against defined criteria, treated by selecting controls, compared with the 93 controls of Annex A across four themes, and recorded in a Statement of Applicability and a treatment plan that risk owners approve. Physical, people and many technological controls reach well beyond the SMS.
Where the two genuinely meet
Clause 8.7.3 is the hinge. ISO/IEC 20000-1 requires an information security policy (8.7.3.1), controls addressing assessed information security risks (8.7.3.2) and the management of information security incidents (8.7.3.3). An ISMS over the same services meets that clause fully. In the other direction, Annex A of the 2022 edition includes configuration management (8.9) and ICT readiness for business continuity (5.30), both of which draw on records the SMS already keeps.
Mapping table: shared requirements, two applications
Where the two columns describe the same activity, build one process and put the differences inside it.
| Area | ISO/IEC 20000-1 (SMS) | ISO/IEC 27001 (ISMS) | One integrated process |
|---|---|---|---|
| Context and scope (4) | Services, customers, locations and parties in the service lifecycle | Information, systems, sites and interfaces to protect | One context analysis; two scope statements checked against each other |
| Policy and roles (5) | Service management policy; service and process owners | Information security policy; risk owners | One policy set; one role matrix naming both kinds of owner |
| Risk and planning (6) | Risks to services and the SMS; service management plan | Information security risk assessment and treatment; Statement of Applicability | One risk method and register, with security risks carried to the Statement of Applicability |
| Support (7) | Competence of service staff; knowledge (7.6) | Competence for security roles; awareness | One competence and awareness record; one document control |
| Suppliers (8.3.4 / Annex A supplier controls) | Contracts and internal agreements aligned to SLAs | Security requirements in supplier relationships and cloud services | One supplier register and one review covering performance and security |
| Change and configuration (8.5.1, 8.2.6 / Annex A 8.9) | Requests for change assessed and approved; configuration information | Controlled configuration; changes assessed for security impact | One change process with a security assessment step; one configuration record |
| Incidents (8.6.1, 8.7.3.3 / Annex A incident controls) | Incidents resolved to targets; major-incident procedure | Security events reported, assessed and learned from | One incident route with a security classification and escalation |
| Continuity (8.7.2 / Annex A 5.30) | Service continuity plans, tested | ICT readiness for business continuity | One set of plans and tests serving both |
| Evaluation and improvement (9, 10) | Internal audit, management review, service reporting | Internal audit, management review, security measures | One audit programme, one review, one corrective-action log |
One risk method, one document set, one audit programme
The risk method
Two methods produce two registers that disagree about the same outage. Use one method with criteria wide enough for service and security risk, and flag security risks so they flow into the Statement of Applicability and treatment plan.
The document set
Write document control, competence, audit, review and corrective action once. Keep the service management plan, catalogue and SLAs on the SMS side and the Statement of Applicability on the ISMS side, cross-referenced; see our documentation guide.
Internal audit and management review
Audit by service and process so one trail tests both: a sampled change shows whether it was approved, released to criteria and assessed for security impact. The team needs both competences between its members; see our internal audit guide. One management review serves both if its agenda carries every input each standard names.
The combined certification audit
A certification body can audit both standards in one visit only if it is accredited for both. For the SMS that means ISO/IEC 17021-1 plus ISO/IEC 20000-6; for the ISMS, ISO/IEC 17021-1 plus ISO/IEC 27006-1. Check both accreditations, and the scope each covers, before comparing quotations.
Accredited bodies plan such audits under IAF MD 11. You state at application how far documents, system elements and responsibilities are shared; the body sums each standard's audit time, then adjusts it down for real integration or up for complexity, recording why. The report is integrated, and a nonconformity against a shared requirement counts against the whole system.
A standard certified for the first time still needs Stage 1 and Stage 2; see the certification process guide.
Which to implement first, and how to add the second
Let the contract decide. If customers mainly ask about data protection, the ISMS usually comes first; if the pressure is on service levels and outages, the SMS comes first and clause 8.7.3 becomes the entry point for a full ISMS.
- Adding ISO/IEC 27001 to a certified SMS: widen the risk method to information security criteria, build the asset inventory from the configuration records, complete the Statement of Applicability, extend awareness and supplier reviews, and evidence the remaining controls.
- Adding ISO/IEC 20000-1 to a certified ISMS: agree the catalogue and service levels with customers, write the service management plan, bring change, release, problem, capacity and availability management under the system, and start producing service reports.
How Sterling integrates service management and security
One system your service teams run and two certificates your customers can check.
Under the Sterling Business Excellence Framework™, whatever mix of management system standards you hold becomes a single system, audited once. Our expert and experienced consultants design the processes with your service owners and security leads, build a single risk method and set up the management-system layer in Effivity, included with the engagement at no additional cost, while ticket-level records stay in your ITSM tool. Sustain™ keeps the system running between surveillance audits. We ensure successful certification for our clients. An independent, accredited certification body audits and decides; Sterling does not certify.
Book a free discovery callISO 20000-1 and ISO 27001: questions buyers ask
Does meeting clause 8.7.3 of ISO/IEC 20000-1 mean we already meet ISO/IEC 27001?
No. Clause 8.7.3 asks for a security policy, risk-based controls and incident management within the SMS, but ISO/IEC 27001 also requires its full risk assessment and treatment method, a Statement of Applicability against all 93 Annex A controls and an ISMS audited in its own right. Clause 8.7.3 is a strong starting point, not a substitute.
Can the two certificates cover different scopes?
Yes, and they often do. The SMS scope names services and customers, while the ISMS scope names the information, systems and sites being protected; a provider may certify its managed services under ISO/IEC 20000-1 and the wider organisation under ISO/IEC 27001. Write both together so the interfaces are explicit.
Can one certification body audit both standards?
Only if it is accredited for both, under ISO/IEC 20000-6 for service management and ISO/IEC 27006-1 for information security, each on top of ISO/IEC 17021-1.
Is there official guidance on integrating ISO/IEC 20000-1 and ISO/IEC 27001?
Yes, ISO/IEC 27013:2021. It is guidance, not an auditable standard, so certification remains against the two standards themselves.
Does a combined audit take fewer auditor days than two separate audits?
Usually, if the integration is real; two systems filed side by side earn little reduction. The larger saving is internal: one preparation, one set of interviews and aligned surveillance visits.
More ISO/IEC 20000-1 guides
Every guide in the ISO/IEC 20000-1 series is written for one question and links back to the hub for the whole picture.
- ISO/IEC 20000-1 certification process, step by step
- ISO/IEC 20000-1 certification cost: what moves the price
- ISO/IEC 20000-1 documentation: the service management plan, catalogue and SLAs
- Effivity for ISO/IEC 20000-1: the guide
- ISO/IEC 20000-1 internal audit: planning, conduct and reporting
- ISO/IEC 20000-1 requirements explained, clause by clause
- ISO/IEC 20000-1 training: who needs what, and the evidence of competence
- ISO 20000-1 vs ISO 27001
- ISO/IEC 20000-1 vs ITIL 4: framework, standard and how they fit
- ISO/IEC 20000-1 and ISO/IEC 27001: one integrated system
Keep exploring
Explore more about ISO/IEC 20000-1
Watch a video on how to implement ISO 20000-1 here.
Watch a video on ISO 20000-1 requirements here.
ISO/IEC 20000-1 resources
Services for ISO/IEC 20000-1
Industries
Talk to a consultant
Build service management and information security as one system, audited together.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice