Integrating ISO/IEC 27001 with ISO/IEC 27701 and ISO 22301: one management system for security, privacy and continuity

One system on a shared frame

The three standards can run as one management system, and for an organisation that already runs an information security management system (ISMS), that is the sensible way to add privacy and continuity. The alternative, two new programmes beside the ISMS, means three policies, registers and review meetings examining the same systems, suppliers and incidents. Integration keeps one frame and writes separately only what genuinely differs.

That frame is ISO's harmonised structure, formerly the high level structure, which fixes the order and titles of the clauses and much of their text. In all three standards the requirements occupy the same seven clauses: 4 Context of the organisation, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation and 10 Improvement. What is specific to each discipline sits mainly in clauses 6 and 8.

ISO/IEC 27001:2022 and ISO 22301:2019 each carry a 2024 amendment adding climate change to clause 4, so one context analysis answers it for both. ISO 22301:2019 predates the structure's latest update, so its clause 10 puts nonconformity before continual improvement, the reverse of ISO/IEC 27001. Map documents to processes, not clause numbers, and renumbering changes nothing.

What ISO/IEC 27701 and ISO 22301 add to the ISMS

ISO/IEC 27701: privacy information management

ISO/IEC 27701:2025, published on 14 October 2025, replaced the 2019 edition, an extension to ISO/IEC 27001 and ISO/IEC 27002 that could be certified only on top of an ISMS certificate. The new edition is an independent standard for a privacy information management system (PIMS), with its own clauses 4 to 10. ANAB and UKAS, among others, end the transition for 2019 certificates on 31 October 2028; confirm with your certification body and see the ISO/IEC 27701:2025 transition guide.

Privacy adds a second subject: the individuals whose personally identifiable information (PII) you process. You declare your role as PII controller, PII processor or both, assess risk to those individuals as well as to the organisation, and apply the Annex A controls for that role: A.1 for controllers (lawful basis, notices, rights requests, privacy by design and by default), A.2 for processors (the customer's documented instructions, sub-processors, return and deletion) and A.3 for the security controls both need.

ISO 22301: business continuity

ISO 22301:2019, with its 2024 amendment, is the certifiable edition for a business continuity management system (BCMS); ISO lists it as to be revised, with a committee draft under development and no publication date. Its own content sits in clause 8:

• 8.2 Business impact analysis and risk assessment: prioritised activities, their resumption time frames, resources and dependencies, and the risks of disruption.
• 8.3 Business continuity strategies and solutions: chosen, resourced and implemented.
• 8.4 Business continuity plans and procedures: response structure, warning and communication, recovery.
• 8.5 Exercise programme and 8.6 Evaluation of business continuity documentation and capabilities.

Annex A control 5.30, ICT readiness for business continuity, draws on the same business impact analysis (BIA), which sets the recovery objectives ICT must meet.

One risk method, three kinds of consequence

ISO/IEC 27001 requires criteria, owners, consequences and likelihood; ISO/IEC 27701 adds risk to the people whose data you hold; ISO 22301 measures the impact of disruption over time. Use one likelihood scale, register, set of owners and approval route, with consequence criteria for each lens, and align the scales where they meet: if the BIA and the ISMS rate the same outage differently, an auditor will ask which one management believes.

A single method also settles the tensions between the disciplines:

• Monitoring against minimisation. Security logs hold personal data, so the PIMS limits their purpose, access and retention.
• Recovery against transfer rules. A recovery site or backup replica abroad can be a cross-border transfer under data protection law.
• Backups against deletion. Continuity wants data restorable, privacy wants it gone when retention ends; decide how deletion reaches backups.

Mapping the shared requirements across the three standards

Each row is one process; the columns show what each standard needs from it.

One set of documents, one audit programme, one review

The documents

Write the common processes once: document control, competence and awareness, communication, change, suppliers, incidents, internal audit, management review and corrective action. One supplier assessment covers security, the supplier's role as sub-processor and its place among your continuity dependencies. One incident process routes each report three ways: security incident, personal data breach with any legal notification deadline, and disruption that may invoke a plan. Keep separate what differs: the Statement of Applicability, the records of processing, the BIA and the plans. A merged policy must keep every commitment each standard requires of its own.

The audit programme

Plan around services, not standards: one audit of client onboarding can test access provisioning, the data processing agreement and the service's place in the BIA. The audit team needs security, privacy and continuity competence across its members; our internal audit guide covers the rest.

The review

Hold management review once, on an agenda built from all three input lists: security risks and control performance; requests, breaches and processing changes; exercise results and whether the BIA still describes the business. Our management review guide shows what the minutes need.

The combined audit: one visit, three accreditations

The certification body's accreditation must cover each standard. ISO/IEC 27006-1 sets additional requirements for bodies certifying an ISMS, ISO/IEC 27706 for bodies certifying a PIMS, and ISO/IEC TS 17021-6 the competence of BCMS auditors. Confirm each, and that the accreditation body is recognised through the Global ACI arrangement; our guide to choosing a certification body explains how.

• Audit time. Each standard's time is set under its own rules and the totals added; IAF MD 11 then allows a capped, justified reduction for integration, for staff who answer on several standards and for multi-standard auditors, or an increase for complexity.
• The team. Together the auditors must cover each standard's competence; the leader must be competent in at least one.
• The report. One report, each finding tied to its standard. A failure in a shared process is a nonconformity for the whole system; one in, say, the exercise programme affects ISO 22301 alone.
• The visits. A newly added standard needs its own Stage 1 and Stage 2 audits; with the ISMS certified, ask whether they can coincide with a surveillance visit, then align the cycles (see surveillance and recertification).

Auditor days fall, within that cap; your larger saving is one body of evidence, prepared once.

Integrating ISO/IEC 27001, ISO/IEC 27701 and ISO 22301: questions buyers ask