Combining ISO 20000 and ISO 27001
ISO 20000-1 and ISO 27001 are two different standards that work very well together. ISO 20000-1 covers the quality of your IT service delivery (a service management system), while ISO 27001 covers protecting information (an ISMS). They share the same basic structure: the High Level Structure (HLS) . This means you can combine both standards in one integrated management system and reuse a lot of work. For the official approach, there is ISO/IEC 27013 , a guideline that describes how to implement them together.
Many IT service providers hold both certificates. A customer wants to know that its data is safe (ISO 27001) and that the service is delivered reliably (ISO 20000-1). You can also read how ISO 27001 works for SaaS companies, as that target group overlaps strongly.
In short: ISO 27001 protects information, while ISO 20000-1 ensures service quality. The first says “your data is safe”, the second says “your service works and keeps working”.
Why the two standards look alike
Since the 2018 version, ISO 20000-1 follows the same HLS as ISO 27001. This means clauses 4 to 10 largely have the same layout. Clause 4 always covers context, and clause 9 always covers evaluation. If you know one standard, you will immediately recognise the structure of the other.
This shared layout is no coincidence. ISO designed the HLS specifically so that organisations can stack standards without doing the same work twice. Already have ISO 27001? Then much of the backbone of your ISO 20000-1 system is already in place.
What you can reuse
The biggest gain is in the shared parts. The table shows what you often arrange once for both standards.
| Component | Applies to both? |
|---|---|
| Context and scope (clause 4) | Yes, often largely the same |
| Leadership and policy (clause 5) | Yes, one management commitment |
| Risk approach (clause 6) | Yes, with a different focus per standard |
| Document control (clause 7) | Yes, one system |
| Internal audit (clause 9) | Yes, a combined audit is possible |
| Management review (clause 9) | Yes, in one meeting |
| Improvement (clause 10) | Yes, one improvement process |
Pay attention to the difference in focus. For clause 6, ISO 27001 looks at security risks, while ISO 20000-1 looks at risks to the service. The structure is the same, but the content differs.
Where the standards differ
The core does differ. ISO 27001 is built around the CIA triad: confidentiality, integrity and availability of information. ISO 20000-1 is built around the service management processes: incidents, changes, SLAs and releases. Those processes in clause 8 are unique to ISO 20000-1. We cover them on the service management processes.
An example makes this concrete. A leaked password is an ISO 27001 issue. A helpdesk that does not answer calls within the agreed time is an ISO 20000-1 issue. Sometimes they overlap: an outage can be both an availability issue and a security issue.
Do not underestimate the extra requirements of ISO 20000-1. The shared HLS saves work, but you still need to set up clause 8, the service management processes, separately. This is where most of the time goes during an audit.
The guideline ISO/IEC 27013 describes this combined approach in detail. Read the explanation of ISO/IEC 27013.
How to combine both
The practical route is an integrated management system. You build one set of documents, one audit plan and one management review, with the specific parts for each standard added. ISO/IEC 27013 provides the official guidance for this.
Many certification bodies, such as DNV and Kiwa , offer a combined audit. This is more efficient and cheaper than two separate processes. The step-by-step plan and the costs and timeline help you plan.
Who benefits from combining?
Mainly managed service providers, hosting companies and cloud providers. They manage customer data (security) and deliver a service with agreements (service quality). For these companies, the combination is almost standard, especially in tenders that ask for both certificates.
Do you work for the American market? Then you often come across SOC 2 alongside these standards, which demonstrates security and availability in a different way.
Next steps
Sources
- ISO/IEC 27013: integrated implementation of 27001 and 20000-1 , International Organization for Standardization
- ISO/IEC 20000-1:2018: service management system requirements , International Organization for Standardization
- ISO/IEC 27001:2022: information security management systems , International Organization for Standardization