ISO/IEC 27013 explained: implementing ISO 27001 and 20000-1 in an integrated way
ISO/IEC 27013 is a guideline for implementing ISO/IEC 27001 and ISO/IEC 20000-1 together. The document describes how to set up one management system that covers both information security and service management, instead of two separate systems side by side. The current edition is the third, from 2021 (IEC Webstore ). There may also be a short amendment from 2024 (Amd 1:2024) that refers to ISO 27001 and 27002 from 2022. Check this in the webstore before you order the guideline. It is a guideline, not a requirements standard, so you cannot certify against it. The two standards themselves are ISO 20000-1 and ISO 27001. The connection between them is explained on combining ISO 20000 and ISO 27001.
The document is mainly intended for organisations that want to achieve both standards or already have them. Think of a managed service provider (MSP) that promises customers both information security and service quality. Without such a guideline, you often write the same policy twice, run the same internal audit twice and hold the same management review twice.
Why does this guideline exist?
Both standards follow the High Level Structure (HLS), the shared layout of ISO management system standards. Clauses 4 to 10 have the same headings: context, leadership, planning, support, operation, evaluation and improvement. That is the basis for integration. But the content differs: one standard looks at protecting information, the other at the quality of the service.
ISO/IEC 27013 helps you decide what you can share and where you need separate measures. In that sense, it is a manual for the choices you have to make anyway.
What do you share, and what not?
The guideline distinguishes between parts you do once and parts that differ per standard. The table below gives a simplified view.
| Component | Shared? | Explanation |
|---|---|---|
| Scope and context | Yes, with a separate scope per standard | You describe one organisation, but the scope of security and service may differ |
| Leadership and policy | Yes, one policy with sections | A policy that covers security and service together |
| Risk assessment | Shared as a method, separate as content | One method, two types of risk: to information and to the service |
| Document control | Yes | One document list, one control process |
| Internal audit | Yes, with two checklists | One audit programme with separate test questions per standard |
| Management review | Yes | One meeting with both topics on the agenda |
| Corrective actions | Yes | One register for nonconformities from both standards |
| Security controls | Separate | Annex A of ISO 27001 is not the same as the process clauses of ISO 20000-1 |
Example: one document list for two standards
A fictional hosting provider with 30 employees uses one document list. Each document gets a label showing the standard it provides evidence for.
| Document | For ISO 27001 | For ISO 20000-1 |
|---|---|---|
| Information security policy and service policy | Yes | Yes |
| Risk register | Yes, on information | Yes, on services |
| Incident procedure | Yes, security incidents | Yes, service disruptions |
| Change procedure | Yes, changes with a security impact | Yes, all changes |
| Statement of applicability (SoA) | Yes | No |
| Service catalogue | No | Yes |
So the incident procedure exists once, but it is used twice, with a different angle each time. That is the advantage of the guideline: you limit the number of documents without losing content.
What the auditor sees
In a combined audit, the auditor looks at both standards. They want to see that the management system is one whole and not separate piles. That means the management review discusses both topics and the internal audit works through both checklists.
How a combined audit runs is described on the audit page for ISO 20000-1. Ask the certification body in advance whether you will receive one joint audit report.
Common mistakes
Many organisations think that integrating means all requirements fit into one document. That is not the case. A shared policy works well, but the measures from Annex A of ISO 27001 and the service measures from ISO 20000-1 remain separately recognisable.
- Merging too quickly. Start with the scope and the policy, and only then combine the processes.
- No separate evidence. Each requirement still needs evidence that links to the right standard.
- Using an outdated edition. Check which edition of the guideline and of the standards you are using.
What does the guideline not say?
The guideline does not say that you will get both certificates in one audit. That depends on the certification body and the agreements you make with it. The guideline also does not say that the standards are identical. They share a structure, not content.
If you want to know what the combination means in cost and time, the cost page for ISO 20000-1 is a good starting point. For the information security side, see the ISO 27001 costs.
Step by step: setting up an integrated system
You do not build a combined management system in one go. The order below prevents you from doing the same work twice.
- Record the shared scope. Which organisation, which locations and which services fall under both standards? Write the overlap first, then the differences.
- Draw up one policy. A service policy and an information security policy can sit in one document, with separate sections for each standard.
- Create one risk method. Choose one way of assessing risks and use it for both security and service delivery.
- Set up the shared processes. Think of document control, internal audit, management review and the register for nonconformities.
- Add the standard-specific parts. Annex A of ISO 27001 and the service measures of ISO 20000-1 each get their own chapter or appendix.
- Test together and separately. Carry out one internal audit with two checklists, so you can see what is in order for each standard.
This order fits the logic of the HLS structure. You start with context and leadership, and finish with improvement.
Example: shared roles in a small organisation
A fictional hosting provider with 30 employees divides the roles as follows. The example shows that you do not need a separate role for each standard.
| Role | Responsible for | For which standard |
|---|---|---|
| Director | Setting the policy, leading the management review | Both |
| Security officer | Risk register, security controls, incidents with a security impact | ISO 27001 |
| Service manager | Service catalogue, SLAs, service desk | ISO 20000-1 |
| Quality lead | Internal audit, nonconformity register, document control | Both |
The security officer and the service manager are not the same person, but they work with the same document list and the same nonconformity register. That is the core of the integration.
Common misunderstandings
- “Then I only need to achieve one standard.” No. You certify against both standards, and the guideline does not change that.
- “The guideline is a requirement.” No. It is a tool. You can also have two separate systems, although that is usually more expensive.
- “The same documents are enough.” Not always. A document that applies to security does not automatically meet the requirements for service management, and the other way round.
Next steps
Sources
- NEN: IT service management with ISO/IEC 20000 , Nederlands Normalisatie-instituut (Dutch Standardisation Institute)
- BSI: ISO/IEC 20000-1 Service Management , British Standards Institution