Integrated Management System Mapping Template (ISO/IEC 27013, 27001)

Integrated Management System Mapping and Plan: [Organization name]

Plans and documents the integration of an information security management system (ISMS) under ISO/IEC 27001:2022 + Amd 1:2024 with other management systems: a service management system under ISO/IEC 20000-1:2018 + Amd 1:2024 (guided by ISO/IEC 27013:2021 + Amd 1:2024), and quality (ISO 9001:2026) and business continuity (ISO 22301:2019 + Amd 1:2024) systems through the common harmonized structure. It gives a clause mapping, the shared processes, a document consolidation plan and the arrangements for integrated audits. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

• 1. Purpose and scope
• 2. Systems in scope and level of integration
• 3. Integration principles
• 4. Clause mapping across the harmonized structure
• 5. ISMS and service management: ISO/IEC 27013 integration points
• 6. Common processes
• 7. Document consolidation plan
• 8. Integrated internal audit and management review
• 9. Integrated certification audits
• 10. Integration roadmap
• 11. Size tiers
• 12. Records and evidence
• 13. References
• Standard and licence note

1. Purpose and scope

This plan describes how [Organization name] runs one management system that meets the requirements of several standards, and how it will be audited. It covers:

• the systems and certificates in scope and their boundaries (section 2);
• the clause-by-clause mapping and the shared processes (sections 4 and 6);
• the specific integration of information security and service management that ISO/IEC 27013 addresses (section 5);
• document consolidation (section 7);
• integrated internal audit, management review and certification audits (sections 8 and 9).

ISO/IEC 27013:2021 gives guidance for three situations: implementing ISO/IEC 27001 where ISO/IEC 20000-1 already exists (or the reverse), implementing both together, and integrating two existing systems. It focuses only on those two standards. The integration with ISO 9001 and ISO 22301 in this plan relies on the common structure that ISO management system standards share (the harmonized structure of the ISO/IEC Directives, Annex SL), not on ISO/IEC 27013.

2. Systems in scope and level of integration

2.1 Systems and scopes

ISO 9001:2026 was published on 2026-09-16. Agree the transition plan for an existing ISO 9001:2015 certificate with your certification body and check the transition period that applies.

2.2 Integration level self-assessment

Score each element: 0 = separate per standard, 1 = partly shared, 2 = fully integrated.

Example (Quillmere Group): the QMS and BCMS already share document control, internal audit, management review and the corrective action log (score 2 on those four rows). The ISMS will join them; its risk method will be added as an information security module of the group risk method rather than a separate method.

3. Integration principles

4. Clause mapping across the harmonized structure

All four standards follow the common structure (clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation, improvement). ISO/IEC 27001:2022 uses the harmonized structure, and ISO 9001:2026 is built on the same pattern (check the published text); ISO 22301:2019 and ISO/IEC 20000-1:2018 use the earlier high-level structure, which has the same clause pattern apart from a few sub-clauses (6.3 and the order inside clause 10). The table uses ISO/IEC 27001 clause numbers as the anchor and describes in this template's own words what is common and what each standard adds.

Blank cells mean "no specific addition beyond the common process". Sub-clause numbers are not identical across the four standards: clause 6.3 and the order of the two clause 10 sub-clauses differ, as the table shows, so cite each standard's own number in audit findings. Check each cell against the official standard before you rely on it. For framework mappings beyond ISO (NIST CSF, SOC 2, CIS), use isms/control-framework-crosswalk; for AI management, see isms/iso-27001-42001-integrated-soa.

5. ISMS and service management: ISO/IEC 27013 integration points

ISO/IEC 27013:2021 compares ISO/IEC 27001 and ISO/IEC 20000-1 and gives guidance on implementing them together. The 2024 amendment updates that guidance; read it alongside the 2021 text. The points below are where the two systems usually meet in practice.

Example (Quillmere Health Systems, 320 staff): the managed service team already runs incident, change and problem management to an ITIL style. The ISMS adds a security classification field to the incident form, a security impact question to every change, and a link from the problem record to post-incident reviews. If the company later seeks ISO/IEC 20000-1 certification, these shared processes carry over.

6. Common processes

7. Document consolidation plan

Rules: one document control procedure applies to every IMS document; each document states which standards it serves in its Document control table; superseded documents are withdrawn and archived, not deleted.

8. Integrated internal audit and management review

8.1 Internal audit

8.2 Management review

One management review (DOC-ISMS-085) covers all systems. The agenda has a common part (context changes, objectives, audit results, nonconformities, resources, opportunities for improvement) and a section per standard for its specific inputs: for the ISMS, for example, risk assessment and treatment status and feedback from interested parties on security; for the BCMS, exercise results and BIA changes; for the QMS, customer satisfaction and product conformity; for the SMS, service performance. Record decisions per system so each standard's outputs are traceable.

9. Integrated certification audits

Certification bodies plan audits of integrated management systems under ISO/IEC 17021-1 and the accreditation community's mandatory document for IMS audits. That document was issued as IAF MD 11 and, after IAF's role passed to the Global Accreditation Cooperation Incorporated (Global ACI), was re-issued as Global ACI-TECH-3-008 version 1.0 (issued 2026-07-10, implementation 2026-08-28). In summary, in this template's words:

• the CB calculates audit time for each standard separately, using the rules for that standard (for ISO/IEC 27001, ISO/IEC 27006-1:2024), adds them as a starting point, and then adjusts for the level of integration, the ability of staff to answer for several standards and the availability of auditors competent in several standards;
• any reduction from that starting point is capped (the document sets 20%), and the starting point and justification are recorded by the CB;
• the level of integration you declare on the application is confirmed at Stage 1 and through the cycle, and audit time may change if it differs;
• the audit team as a whole must be competent for each standard, led by someone competent in at least one;
• reports may be integrated or separate, but each finding must be traceable to its standard, and the CB considers whether a nonconformity against one standard affects the others; if one certificate is suspended, reduced or withdrawn, the CB investigates the impact on the other certificates.

9.1 Audit time planning (Example)

These are illustrative numbers only, for budgeting conversations. The CB sets the real figures in its proposal and audit programme.

9.2 Aligning certificate cycles

Discuss alignment with the CB early: it decides how audits are combined and whether certificate dates can be aligned. See isms/certification-cycle-plan and isms/certification-body-selection.

10. Integration roadmap

11. Size tiers

12. Records and evidence

Set retention in the documented information register (isms/isms-documented-information-register) and map evidence owners in isms/control-evidence-matrix.

13. References

Standard and licence note

Structure aligned with ISO/IEC 27013:2021 + Amd 1:2024, the common management system structure used by ISO/IEC 27001:2022 + Amd 1:2024, ISO/IEC 20000-1:2018 + Amd 1:2024, ISO 9001:2026 and ISO 22301:2019 + Amd 1:2024, and the IMS audit mandatory document Global ACI-TECH-3-008 (based on IAF MD 11). The mapping, principles, tables and examples are original; no text, tables or definitions from ISO, IEC, IAF or Global ACI documents are reproduced, and clause topics are described in this template's own words. Read the official standards before relying on any mapping cell, and follow your certification body's procedures for audit time. Check the current editions before use: ISO 9001 has a 2026 edition, ISO 22301 is under revision, and the accreditation mandatory documents were renumbered under Global ACI in 2026. Official ISO text, purchase or licensed access: https://www.iso.org/standard/78752.html, https://www.iso.org/standard/82875.html and https://www.iso.org/standard/75106.html.

Template licence: MIT.