Overview - ISO/IEC 27013:2021 (Integrated ISMS & SMS)

ISO/IEC 27013:2021 provides guidance for the integrated implementation of an Information Security Management System (ISMS) (ISO/IEC 27001) and a Service Management System (SMS) (ISO/IEC 20000-1). It helps organizations that want to:

implement ISO/IEC 27001 when ISO/IEC 20000‑1 is already in place (or vice versa),
implement both standards concurrently, or
integrate separate management systems based on ISO/IEC 27001 and ISO/IEC 20000‑1.

The standard focuses on aligning the service lifecycle and information security/cybersecurity and privacy protection to avoid duplication, reduce cost, and improve operational efficiency.

Key topics and technical requirements

ISO/IEC 27013:2021 does not reproduce clause text from the normative standards but provides practical mapping and guidance around overlapping and differing areas. Key topics include:

Overview and comparison of ISO/IEC 27001 and ISO/IEC 20000‑1 concepts and terminology (references ISO/IEC 27000:2018).
Approaches for integrated implementation, including scope considerations and typical pre‑implementation scenarios.
Integrated implementation considerations covering technical and process areas such as:
- requirements and controls alignment,
- assets and configuration items,
- service design and transition,
- risk assessment and risk management,
- supplier/third‑party risk,
- incident, problem, major incident management, and evidence collection,
- classification, escalation and change management.
Potential gains from integration: service level management, continual improvement, capacity, continuity and availability, release and deployment management.
Informative annexes mapping clauses and controls between ISO/IEC 27001:2013 and ISO/IEC 20000‑1:2018, plus term comparisons.

Practical applications and users

ISO/IEC 27013 is practical guidance for:

CISOs, CIOs and IT service managers planning integrated ISMS and SMS deployments.
Compliance and risk officers harmonizing security and service requirements.
Managed service providers (MSPs), auditors and consultants implementing or assessing combined management systems.
Organizations of all sizes using technology and digital services that need coordinated cybersecurity, privacy protection and service delivery.

Benefits include stronger credibility for secure services, lower implementation and audit costs, faster deployment, improved communication and reduced duplication of effort.

Related standards

ISO/IEC 27001:2013 - Information security management system (ISMS) requirements
ISO/IEC 20000‑1:2018 - Service management system (SMS) requirements
ISO/IEC 27000:2018 - Overview and vocabulary for ISMS

Keywords: ISO/IEC 27013:2021, integrated implementation, ISMS, SMS, ISO/IEC 27001, ISO/IEC 20000‑1, information security, service management, cybersecurity, privacy protection, risk management, incident management.

Overview - ISO/IEC 27013:2021 (Integrated ISMS & SMS)

implement ISO/IEC 27001 when ISO/IEC 20000‑1 is already in place (or vice versa),
implement both standards concurrently, or
integrate separate management systems based on ISO/IEC 27001 and ISO/IEC 20000‑1.

The standard focuses on aligning the service lifecycle and information security/cybersecurity and privacy protection to avoid duplication, reduce cost, and improve operational efficiency.

Key topics and technical requirements

ISO/IEC 27013:2021 does not reproduce clause text from the normative standards but provides practical mapping and guidance around overlapping and differing areas. Key topics include:

Overview and comparison of ISO/IEC 27001 and ISO/IEC 20000‑1 concepts and terminology (references ISO/IEC 27000:2018).
Approaches for integrated implementation, including scope considerations and typical pre‑implementation scenarios.
Integrated implementation considerations covering technical and process areas such as:
- requirements and controls alignment,
- assets and configuration items,
- service design and transition,
- risk assessment and risk management,
- supplier/third‑party risk,
- incident, problem, major incident management, and evidence collection,
- classification, escalation and change management.
Potential gains from integration: service level management, continual improvement, capacity, continuity and availability, release and deployment management.
Informative annexes mapping clauses and controls between ISO/IEC 27001:2013 and ISO/IEC 20000‑1:2018, plus term comparisons.

Practical applications and users

ISO/IEC 27013 is practical guidance for:

CISOs, CIOs and IT service managers planning integrated ISMS and SMS deployments.
Compliance and risk officers harmonizing security and service requirements.
Managed service providers (MSPs), auditors and consultants implementing or assessing combined management systems.
Organizations of all sizes using technology and digital services that need coordinated cybersecurity, privacy protection and service delivery.

Benefits include stronger credibility for secure services, lower implementation and audit costs, faster deployment, improved communication and reduced duplication of effort.

Related standards

ISO/IEC 27001:2013 - Information security management system (ISMS) requirements
ISO/IEC 20000‑1:2018 - Service management system (SMS) requirements
ISO/IEC 27000:2018 - Overview and vocabulary for ISMS

ISO/IEC 27013:2021 PDF

Technical details

Abstract

Overview - ISO/IEC 27013:2021 (Integrated ISMS & SMS)

Key topics and technical requirements

Practical applications and users

Related standards

Related standards

Abstract

Overview - ISO/IEC 27013:2021 (Integrated ISMS & SMS)

Key topics and technical requirements

Practical applications and users

Related standards

Related standards

Information technology — Security techniques — Information security management systems — Overview and vocabul…

Information technology — Security techniques — Information security management systems — Requirements

Information technology — Service management — Part 1: Service management system requirements

Information security, cybersecurity and privacy protection - Information security management systems - Requir…

Information technology — Security techniques — Guidance on the integrated implementation of ISO/IEC 27001 and…

Information technology — Service management — Part 1: Service management system requirements