# Integrated Management System Mapping and Plan: [Organization name]

> Plans and documents the integration of an information security
> management system (ISMS) under ISO/IEC 27001:2022 + Amd 1:2024 with
> other management systems: a service management system under ISO/IEC
> 20000-1:2018 + Amd 1:2024 (guided by ISO/IEC 27013:2021 + Amd 1:2024),
> and quality (ISO 9001:2026) and business continuity (ISO 22301:2019 +
> Amd 1:2024) systems through the common harmonized structure. It
> gives a clause mapping, the shared processes, a document
> consolidation plan and the arrangements for integrated audits.
> Replace every `[bracketed]` value and every row marked *Example*.

<!--
Guidance: How to use this template
- Use it when the organization already runs one ISO management system
  and adds ISO/IEC 27001, or runs several and wants one set of
  processes, one internal audit programme, one management review and
  one combined certification audit.
- Fill section 2 (systems in scope and integration level) and the
  clause mapping in section 4 first. The mapping shows quickly which
  processes can be shared and which must stay specific.
- The main pitfall is integrating on paper only: one manual that
  stitches four documents together while each team keeps its own risk
  method, audit schedule and corrective action log. Certification
  bodies assess the real level of integration and adjust audit time
  to it.
- Do not drop requirements to make processes fit. Every requirement of
  every standard still has to be met; integration only removes
  duplication.
- Related templates: `compliance/iso-map`, `compliance/iso-20000-service-catalog`,
  `compliance/quality-policy`, `compliance/business-continuity`,
  `compliance/internal-audit-program`, `compliance/management-review`,
  `compliance/controlled-document`, `isms/isms-process-map`,
  `isms/control-framework-crosswalk`, `isms/iso-27001-42001-integrated-soa`.
-->

## Document control

<!-- Guidance: Owned by whoever runs the integrated management system (IMS), often a head of governance, risk and compliance. Each standard's system owner reviews the sections that touch their standard. -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-105 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@ims-manager] |
| Approvers/reviewers | [@ciso], [@quality-manager], [@service-manager], [@bc-manager], [@top-management-sponsor] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024; ISO/IEC 27013:2021 + Amd 1:2024; ISO/IEC 20000-1:2018 + Amd 1:2024; ISO 9001:2026; ISO 22301:2019 + Amd 1:2024 |
| Next scheduled review | YYYY-MM-DD |
| Systems integrated | [ISMS, SMS, QMS, BCMS] |
| Certification body for the combined audit | [CB name, accredited by a Global ACI MRA (formerly IAF MLA) signatory] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| IMS manager | [@ims-manager] | [Prepared] | YYYY-MM-DD |
| System owners | [@ciso], [@quality-manager], [@service-manager], [@bc-manager] | [Reviewed] | YYYY-MM-DD |
| Top management sponsor | [@sponsor] | [Approved] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 | YYYY-MM-DD | [@ims-manager] | First issue |
| [x.y] | YYYY-MM-DD | [@author] | [Change summary] |

## Contents

- [1. Purpose and scope](#1-purpose-and-scope)
- [2. Systems in scope and level of integration](#2-systems-in-scope-and-level-of-integration)
- [3. Integration principles](#3-integration-principles)
- [4. Clause mapping across the harmonized structure](#4-clause-mapping-across-the-harmonized-structure)
- [5. ISMS and service management: ISO/IEC 27013 integration points](#5-isms-and-service-management-isoiec-27013-integration-points)
- [6. Common processes](#6-common-processes)
- [7. Document consolidation plan](#7-document-consolidation-plan)
- [8. Integrated internal audit and management review](#8-integrated-internal-audit-and-management-review)
- [9. Integrated certification audits](#9-integrated-certification-audits)
- [10. Integration roadmap](#10-integration-roadmap)
- [11. Size tiers](#11-size-tiers)
- [12. Records and evidence](#12-records-and-evidence)
- [13. References](#13-references)
- [Standard and licence note](#standard-and-licence-note)

## 1. Purpose and scope

<!-- Guidance: State which standards, which parts of the organization and which certificates this plan covers. Scopes rarely match exactly: the QMS may cover all products while the ISMS covers one platform. Record the differences now; they drive the mapping and the audit plan. -->

This plan describes how [Organization name] runs one management system
that meets the requirements of several standards, and how it will be
audited. It covers:

- the systems and certificates in scope and their boundaries (section 2);
- the clause-by-clause mapping and the shared processes (sections 4 and 6);
- the specific integration of information security and service
  management that ISO/IEC 27013 addresses (section 5);
- document consolidation (section 7);
- integrated internal audit, management review and certification
  audits (sections 8 and 9).

ISO/IEC 27013:2021 gives guidance for three situations: implementing
ISO/IEC 27001 where ISO/IEC 20000-1 already exists (or the reverse),
implementing both together, and integrating two existing systems. It
focuses only on those two standards. The integration with ISO 9001 and
ISO 22301 in this plan relies on the common structure that ISO
management system standards share (the harmonized structure of the ISO/IEC
Directives, Annex SL), not on ISO/IEC 27013.

## 2. Systems in scope and level of integration

<!-- Guidance: Be honest about the current level. A CB confirms the level of integration at Stage 1 and through the cycle; an overstated level leads to an audit time correction and lost credibility. -->

### 2.1 Systems and scopes

| System | Standard and edition | Scope (summary) | Certified since | Certificate expiry | System owner |
|---|---|---|---|---|---|
| QMS *(Example)* | ISO 9001 (certificate to the 2015 edition; transition to ISO 9001:2026 planned) | Design and manufacture of [products] at all group sites | YYYY | YYYY-MM-DD | Quality director |
| BCMS *(Example)* | ISO 22301:2019 + Amd 1:2024 | Continuity of manufacturing and customer service, all sites | YYYY | YYYY-MM-DD | BC manager |
| ISMS *(Example)* | ISO/IEC 27001:2022 + Amd 1:2024 | Group IT and OT, phased by site | Target: 15 months | n/a | CISO |
| SMS | ISO/IEC 20000-1:2018 + Amd 1:2024 | [Managed IT services to internal and external customers] | [Not certified / YYYY] | [YYYY-MM-DD] | [Service manager] |

ISO 9001:2026 was published on 2026-09-16. Agree the transition plan
for an existing ISO 9001:2015 certificate with your certification body
and check the transition period that applies.

### 2.2 Integration level self-assessment

Score each element: 0 = separate per standard, 1 = partly shared,
2 = fully integrated.

| Element | QMS | BCMS | ISMS | SMS | Notes |
|---|---|---|---|---|---|
| Documentation set (one manual, shared procedures, one document control) | [0-2] | [0-2] | [0-2] | [0-2] | [Notes] |
| Policy and objectives (integrated policy or aligned policies, one objectives register) | [0-2] | [0-2] | [0-2] | [0-2] | |
| Risk and opportunity process (one method, one register with tags) | [0-2] | [0-2] | [0-2] | [0-2] | |
| Internal audit (one programme, combined audits) | [0-2] | [0-2] | [0-2] | [0-2] | |
| Management review (one review covering all systems and business strategy) | [0-2] | [0-2] | [0-2] | [0-2] | |
| Corrective action and improvement (one log) | [0-2] | [0-2] | [0-2] | [0-2] | |
| Responsibilities (one IMS owner, defined system owners) | [0-2] | [0-2] | [0-2] | [0-2] | |
| Ability of staff to answer questions for more than one standard | [0-2] | [0-2] | [0-2] | [0-2] | |

*Example (Quillmere Group):* the QMS and BCMS already share document
control, internal audit, management review and the corrective action
log (score 2 on those four rows). The ISMS will join them; its risk
method will be added as an information security module of the group
risk method rather than a separate method.

## 3. Integration principles

<!-- Guidance: Agree these with all system owners before redesigning processes. They settle most later arguments. -->

| ID | Principle | Consequence |
|---|---|---|
| IMS-P01 | One process per topic, with standard-specific steps inside it | One document control procedure, one internal audit procedure, one corrective action procedure |
| IMS-P02 | Every requirement of every standard stays traceable | The clause mapping (section 4) shows where each requirement is met |
| IMS-P03 | Specific stays specific | The SoA, the business impact analysis, the service catalogue and product realization keep their own documents |
| IMS-P04 | One risk language | Same likelihood and impact scales and bands (DOC-ISMS-010) for all risk types, with impact criteria that cover quality, continuity, service and security |
| IMS-P05 | One voice to top management | One management review with inputs from each system |
| IMS-P06 | Owners stay accountable | Each standard keeps a named system owner even when processes are shared |
| IMS-P07 | Integrate where the organization works, not where the standards are | Processes follow the business process map (DOC-ISMS-004) |

## 4. Clause mapping across the harmonized structure

<!-- Guidance: The harmonized structure gives the same clause numbers and core text for clauses 4 to 10, with discipline-specific additions. Map by topic, then note what each standard adds. Use the 27001 clause numbers as the anchor. Numbering inside clause 10 and some sub-clauses differ between editions: check each standard. -->

All four standards follow the common structure (clauses 4 to 10:
context, leadership, planning, support, operation, performance
evaluation, improvement). ISO/IEC 27001:2022 uses the harmonized
structure, and ISO 9001:2026 is built on the same pattern (check the
published text); ISO 22301:2019 and ISO/IEC 20000-1:2018 use the earlier
high-level structure, which has the same clause pattern apart from a
few sub-clauses (6.3 and the order inside clause 10). The
table uses ISO/IEC 27001 clause numbers as the anchor and describes in
this template's own words what is common and what each standard adds.

| 27001 clause | Topic | Common (one process) | ISMS adds | SMS adds (20000-1) | QMS adds (9001, check 2026 changes) | BCMS adds (22301) | IMS process owner |
|---|---|---|---|---|---|---|---|
| 4.1 | Organization and its context | One context analysis; climate change considered as an issue (2024 climate action amendments to 27001, 20000-1 and 22301; check ISO 9001:2026) | Security-relevant issues | Service-relevant issues | Quality-relevant issues | Disruption-relevant issues | IMS manager |
| 4.2 | Interested parties | One register, requirements tagged by system | Security requirements, legal and contractual | Customer service requirements | Customer and product requirements | Continuity requirements, legal | IMS manager |
| 4.3 | Scope | One scope document with a section per standard | Interfaces and dependencies | Services in scope | Products and services, any non-applicable requirements | Products, services and locations in scope | IMS manager |
| 4.4 | Management system | One system and process map | | Establish the SMS (the SMS plan itself sits in 20000-1 clause 6.3) | Process approach (4.4 in 9001) | | IMS manager |
| 5.1 | Leadership and commitment | One leadership statement and review | | | Customer focus | | CEO |
| 5.2 | Policy | Integrated policy or a policy family under one framework | Information security policy | Service management policy | Quality policy | BC policy | CEO |
| 5.3 | Roles and responsibilities | One RACI (DOC-ISMS-006) | Security roles | Service roles | Quality roles | BC roles and teams | IMS manager |
| 6.1 | Risks and opportunities | One method, one register with tags | Risk assessment and treatment (6.1.2, 6.1.3) and the SoA | Service risks | Quality risks and opportunities | Risks and opportunities for the BCMS itself; operational risk assessment and BIA sit in 22301 clause 8.2 | Risk manager |
| 6.2 | Objectives | One objectives register (DOC-ISMS-024) | Security objectives | Service objectives | Quality objectives | BC objectives | IMS manager |
| 6.3 | Planning of changes | One change planning process for the management system (DOC-ISMS-025) | New in 27001:2022 | 20000-1:2018 uses 6.3 for the SMS plan, not for planning of changes | Planning of changes (9001 has had 6.3 since 2015) | Planning changes to the BCMS (22301 6.3) | IMS manager |
| 7.1 | Resources | One resource plan | | | Monitoring and measuring resources, organizational knowledge | | CFO |
| 7.2 | Competence | One competence matrix (DOC-ISMS-026) | Security competence | Service competence | Quality competence | BC competence | HR |
| 7.3 | Awareness | One awareness programme with modules | Security awareness | | | BC awareness | HR |
| 7.4 | Communication | One communication plan (DOC-ISMS-027) | | | Customer communication | Warning and communication during disruption | Communications |
| 7.5 | Documented information | One document control procedure and register (DOC-ISMS-028) | Documents required by 27001 | Documents required by 20000-1 | Documents required by 9001 | Documents required by 22301 | Document controller |
| 8.1 | Operational planning and control | One operations plan and outsourced process control | | | | | COO |
| 8 (rest) | Discipline-specific operation | Kept specific | Risk assessment and treatment in operation (8.2, 8.3), Annex A controls | Service portfolio, relationships and agreements, supply and demand, design and transition, resolution and fulfilment, service assurance | Product and service realization | Business impact analysis and risk assessment, strategies and solutions, plans, exercise programme, evaluation | System owners |
| 9.1 | Monitoring and measurement | One measurement programme (DOC-ISMS-080) with indicators per system | Security indicators | Service reporting | Customer satisfaction, product conformity | BC performance | IMS manager |
| 9.2 | Internal audit | One programme, combined audits (section 8) | | | | | Head of internal audit |
| 9.3 | Management review | One review with inputs from each system (section 8) | Security inputs | Service inputs | Quality inputs | BC inputs | CEO |
| 10 | Improvement, nonconformity and corrective action | One corrective action log (DOC-ISMS-087) and improvement register (DOC-ISMS-088) | 10.1 continual improvement, 10.2 nonconformity | 10.1 nonconformity, 10.2 continual improvement | 10.2 nonconformity, 10.3 continual improvement | 10.1 nonconformity, 10.2 continual improvement | IMS manager |

Blank cells mean "no specific addition beyond the common process".
Sub-clause numbers are not identical across the four standards: clause
6.3 and the order of the two clause 10 sub-clauses differ, as the
table shows, so cite each standard's own number in audit findings.
Check each cell against the official standard before you rely on it.
For framework mappings beyond ISO (NIST CSF, SOC 2, CIS), use
`isms/control-framework-crosswalk`; for AI management, see
`isms/iso-27001-42001-integrated-soa`.

## 5. ISMS and service management: ISO/IEC 27013 integration points

<!-- Guidance: This is where integration pays off most in IT organizations: incidents, changes, suppliers, capacity and continuity are run once for both systems. Use ISO/IEC 27013 for the detailed guidance; the table is a planning summary in this template's words. -->

ISO/IEC 27013:2021 compares ISO/IEC 27001 and ISO/IEC 20000-1 and
gives guidance on implementing them together. The 2024 amendment
updates that guidance; read it alongside the 2021 text. The points
below are where the two systems usually meet in practice.

| Area | Service management view | Information security view | Integrated arrangement | Watch-out |
|---|---|---|---|---|
| Incident management | Restore service quickly | Contain, investigate, preserve evidence, notify | One incident process with a security classification step and hand-off to the security response plan (DOC-ISMS-020) | Fast restoration that destroys evidence |
| Service requests and access | Fulfil requests efficiently | Approve and record access according to rules | Access requests run through the service desk with approval rules from the access control policy (DOC-ISMS-041) | Requests approved by the requester's peer |
| Change management | Control risk to services | Security review of changes | One change process with a security impact question in every change (`ops/change-request`) | Standard changes that bypass the security question |
| Problem management | Remove root causes of incidents | Learn from incidents (A.5.27) | One problem record (`ops/problem-record`) linked to post-incident reviews (DOC-ISMS-022) | Security problems kept outside the problem register |
| Supplier management | Manage service suppliers and agreements | Supplier security requirements | One supplier register (DOC-ISMS-066) with security tiering | Two registers with different supplier lists |
| Service level management | Agree and report service levels | Availability and confidentiality obligations | Security obligations inside the SLA (`ops/service-level-agreement`) | Security reporting missing from service reviews |
| Capacity and availability | Meet demand and availability targets | Availability as a security property, resource monitoring | One capacity plan (`ops/capacity-plan`) | |
| Service continuity | Continue services at agreed levels | Security during disruption, ICT readiness | One continuity approach with the BCMS (DOC-ISMS-121, DOC-ISMS-047) | Recovery plans that disable security controls |
| Configuration management | Accurate configuration items | Asset inventory | CMDB as the source of the asset inventory (DOC-ISMS-012, `ops/cmdb-data-model`) | Assets in the CMDB with no information owner |
| Release and deployment | Controlled releases | Secure development and testing | Release criteria include security tests (DOC-ISMS-065) | |

*Example (Quillmere Health Systems, 320 staff):* the managed service
team already runs incident, change and problem management to an ITIL
style. The ISMS adds a security classification field to the incident
form, a security impact question to every change, and a link from the
problem record to post-incident reviews. If the company later seeks
ISO/IEC 20000-1 certification, these shared processes carry over.

## 6. Common processes

<!-- Guidance: List each shared process with one owner, one procedure and the standard-specific steps inside it. This is the core of the IMS: if a process here has two owners, it is not integrated. -->

| ID | Common process | Procedure | Owner | Standard-specific steps inside it |
|---|---|---|---|---|
| IMS-PR-01 *(Example)* | Document and record control | `compliance/controlled-document` | Document controller | Retention for security records; product records retention per customer contracts |
| IMS-PR-02 *(Example)* | Context, interested parties and legal register | DOC-ISMS-003, DOC-ISMS-014 | IMS manager | Security and privacy laws; product safety rules; continuity obligations |
| IMS-PR-03 *(Example)* | Risk and opportunity management | DOC-ISMS-010 with modules | Risk manager | ISMS: risk treatment and SoA; BCMS: business impact analysis; QMS: opportunities |
| IMS-PR-04 *(Example)* | Objectives and measurement | DOC-ISMS-024, DOC-ISMS-080 | IMS manager | Indicators per system |
| IMS-PR-05 *(Example)* | Competence and awareness | DOC-ISMS-026 | HR | Role-specific modules |
| IMS-PR-06 *(Example)* | Internal audit | `compliance/internal-audit-program` | Head of internal audit | Auditor competence per standard |
| IMS-PR-07 *(Example)* | Management review | `compliance/management-review` | CEO | Inputs required by each standard |
| IMS-PR-08 *(Example)* | Nonconformity, corrective action and improvement | `compliance/capa-nonconformity`, DOC-ISMS-088 | IMS manager | Classification of findings by standard |
| IMS-PR-09 *(Example)* | Supplier management | DOC-ISMS-066, DOC-ISMS-067 | Procurement | Security assessment; quality approval; continuity capability |
| IMS-PR-10 *(Example)* | Change planning | DOC-ISMS-025 | IMS manager | |
| IMS-PR-11 | [Process] | [Procedure] | [@owner] | [Specific steps] |

```mermaid
flowchart LR
  CTX["Context and interested parties"] --> RISK["Risk and opportunity: one method"]
  RISK --> SOA["ISMS: risk treatment and SoA"]
  RISK --> BIA["BCMS: business impact analysis"]
  RISK --> QOPP["QMS: quality risks and opportunities"]
  SOA --> OPS["Operation: shared and specific processes"]
  BIA --> OPS
  QOPP --> OPS
  OPS --> MEAS["One measurement programme"]
  MEAS --> AUD["One internal audit programme"]
  AUD --> MR["One management review"]
  MR --> CAPA["One corrective action and improvement log"]
  CAPA --> CTX
```

## 7. Document consolidation plan

<!-- Guidance: Decide which documents merge, which stay separate and which are retired. Keep document IDs stable where other documents reference them. Pitfall: merging so much that one change to a security procedure forces re-approval of the quality manual. -->

| Current documents | Action | Target document | Owner | Due |
|---|---|---|---|---|
| Quality manual, BCMS manual *(Example)* | Merge, add ISMS sections | IMS manual (based on DOC-ISMS-008) | IMS manager | [YYYY-MM-DD] |
| Quality policy, BC policy, draft security policy *(Example)* | Keep separate topic policies under one policy framework | Policy framework DOC-ISMS-005 with DOC-ISMS-001 | CEO | [YYYY-MM-DD] |
| Three document control procedures *(Example)* | Merge | One procedure, one register DOC-ISMS-028 | Document controller | [YYYY-MM-DD] |
| Separate risk registers *(Example)* | Merge with type tags | Group risk register DOC-ISMS-016 | Risk manager | [YYYY-MM-DD] |
| Statement of Applicability *(Example)* | Keep separate (ISMS-specific) | DOC-ISMS-011 | CISO | n/a |
| Business impact analysis *(Example)* | Keep separate (BCMS-specific), reuse for ISMS availability impacts | DOC-ISMS-120 | BC manager | n/a |
| Two internal audit schedules *(Example)* | Merge | One programme DOC-ISMS-082 | Head of internal audit | [YYYY-MM-DD] |
| [Document] | [Merge / Keep / Retire] | [Target] | [@owner] | [YYYY-MM-DD] |

Rules: one document control procedure applies to every IMS document;
each document states which standards it serves in its Document control
table; superseded documents are withdrawn and archived, not deleted.

## 8. Integrated internal audit and management review

<!-- Guidance: Combined internal audits save time only when auditors are competent in each standard they cover. Plan the audit programme so every requirement of every standard is covered over the cycle, and keep findings traceable to the standard they relate to. -->

### 8.1 Internal audit

| Item | Arrangement |
|---|---|
| Programme | One programme (DOC-ISMS-082) covering all clauses of all standards over [the three-year cycle], with higher frequency for high-risk processes |
| Audit type | Process audits that cover several standards at once (for example, the supplier management process against 27001, 9001 and 22301 requirements), plus standard-specific audits where needed (Annex A controls, BC exercise evaluation) |
| Auditor competence | Each audit team as a whole is competent in each standard it covers; the lead is competent in at least one; independence from the audited area |
| Findings | Each finding names the standard and clause it relates to; a finding against one standard is checked for impact on the others |
| Checklists | ISMS checklist (`isms/isms-internal-audit-checklist`) used as the security module of combined checklists |

### 8.2 Management review

One management review (DOC-ISMS-085) covers all systems. The agenda
has a common part (context changes, objectives, audit results,
nonconformities, resources, opportunities for improvement) and a
section per standard for its specific inputs: for the ISMS, for
example, risk assessment and treatment status and feedback from
interested parties on security; for the BCMS, exercise results and BIA
changes; for the QMS, customer satisfaction and product conformity; for
the SMS, service performance. Record decisions per system so each
standard's outputs are traceable.

## 9. Integrated certification audits

<!-- Guidance: The certification body decides audit time and team. Your job is to describe the level of integration accurately on the application, keep it stable through the cycle and align certificate dates. All day figures below are Example values. -->

Certification bodies plan audits of integrated management systems
under ISO/IEC 17021-1 and the accreditation community's mandatory
document for IMS audits. That document was issued as IAF MD 11 and,
after IAF's role passed to the Global Accreditation Cooperation
Incorporated (Global ACI), was re-issued as
Global ACI-TECH-3-008 version 1.0 (issued 2026-07-10, implementation
2026-08-28). In summary, in this template's words:

- the CB calculates audit time for each standard separately, using the
  rules for that standard (for ISO/IEC 27001, ISO/IEC 27006-1:2024),
  adds them as a starting point, and then adjusts for the level of
  integration, the ability of staff to answer for several standards and
  the availability of auditors competent in several standards;
- any reduction from that starting point is capped (the document sets
  20%), and the starting point and justification are recorded by the CB;
- the level of integration you declare on the application is confirmed
  at Stage 1 and through the cycle, and audit time may change if it
  differs;
- the audit team as a whole must be competent for each standard, led by
  someone competent in at least one;
- reports may be integrated or separate, but each finding must be
  traceable to its standard, and the CB considers whether a
  nonconformity against one standard affects the others; if one
  certificate is suspended, reduced or withdrawn, the CB investigates
  the impact on the other certificates.

### 9.1 Audit time planning (Example)

| Standard | Audit days for the standard alone (CB figure) |
|---|---|
| ISO 9001 | 8.0 *(Example)* |
| ISO 22301 | 6.0 *(Example)* |
| ISO/IEC 27001 | 10.0 *(Example)* |
| **Starting point (sum)** | **24.0** |
| Reduction applied by CB for integration (Example: 10%) | 2.4 |
| **Integrated audit time** | **21.6** |
| Maximum reduction allowed (20% of 24.0) | 4.8 |

These are illustrative numbers only, for budgeting conversations. The
CB sets the real figures in its proposal and audit programme.

### 9.2 Aligning certificate cycles

| Certificate | Current expiry | Option to align | Decision |
|---|---|---|---|
| ISO 9001 *(Example)* | 2028-06-30 | Recertify early with the combined audit | [Decision] |
| ISO 22301 *(Example)* | 2029-03-31 | Keep; align at next recertification | [Decision] |
| ISO/IEC 27001 *(Example)* | New | Initial audit combined with 9001 and 22301 surveillance | [Decision] |

Discuss alignment with the CB early: it decides how audits are
combined and whether certificate dates can be aligned. See
`isms/certification-cycle-plan` and `isms/certification-body-selection`.

## 10. Integration roadmap

<!-- Guidance: Integrate shared processes first (document control, internal audit, corrective action, management review), then risk, then operations. The dates below are an Example for Quillmere Group adding 27001 to its 9001 and 22301 IMS. -->

```mermaid
gantt
  title IMS integration, Quillmere Group (Example)
  dateFormat YYYY-MM-DD
  section Foundations
  Clause mapping and gap list      :f1, 2027-01-11, 21d
  Integrated policy framework      :f2, after f1, 21d
  One document control and register :f3, after f1, 30d
  section Risk
  Security module in group risk method :r1, after f2, 30d
  Group risk assessment with security  :r2, after r1, 45d
  section Assurance
  One internal audit programme     :a1, after f3, 21d
  Combined internal audits         :a2, after r2, 30d
  Integrated management review     :a3, after a2, 5d
  section Certification
  Combined CB audit planning       :c1, after a3, 14d
```

| Milestone | Planned date | Owner | Done |
|---|---|---|---|
| Clause mapping approved | [2027-02-01 *(Example)*] | IMS manager | [ ] |
| One document control in use | [2027-03-03 *(Example)*] | Document controller | [ ] |
| Group risk register includes security risks | [2027-05-08 *(Example)*] | Risk manager | [ ] |
| First combined internal audit cycle completed | [2027-06-07 *(Example)*] | Head of internal audit | [ ] |
| Integrated management review held | [2027-06-12 *(Example)*] | CEO | [ ] |

## 11. Size tiers

<!-- Guidance: Small organizations rarely run several certified systems, but often answer customer questionnaires that span quality, continuity and security; a light integration still saves effort. -->

| Aspect | Small: Quillmere Analytics Ltd (46 staff) | Medium: Quillmere Health Systems (320 staff) | Large: Quillmere Group (2,400 staff, 6 sites) |
|---|---|---|---|
| Systems | ISMS only; continuity and quality handled inside it | ISMS, then PIMS (27701) the year after; ITIL-style service management that could lead to 20000-1 | QMS (9001) and BCMS (22301) certified; ISMS added for the group |
| Integration focus | One document control, one risk register, one improvement log that can absorb a future system | ISMS and service management integration (section 5); plan the 27701 addition on the same processes | Full IMS: integrated manual, one risk method, one audit programme, combined CB audits |
| Mapping depth | Not needed beyond the ISMS; keep this template for later | Section 5 table plus clause mapping for 27001 and 27701 | Full section 4 mapping across all standards, with site variations |
| Who runs it | ISMS manager (0.5 FTE, Head of Engineering Operations) | Full-time ISMS manager with the 3-person security team and the service manager | IMS manager with CISO (14-person security office), quality director and BC manager |
| Audits | Single-standard certification audit | Separate audits now; combine when 27701 is added (CB decides) | Combined audits under the IMS mandatory document |

## 12. Records and evidence

<!-- Guidance: These records prove the IMS operates as one system. Map each to the control evidence matrix (DOC-ISMS-033) so the CB can trace integrated processes to evidence. -->

| Record | Proves | Owner | Location | Retention |
|---|---|---|---|---|
| This plan and the clause mapping, approved | Planned integration; traceability of every requirement | IMS manager | [Document management system] | [Current + 3 years] |
| Integration level self-assessment (section 2.2) | Basis for the level declared to the CB | IMS manager | [IMS workspace] | [Certificate cycle] |
| Integrated document register | One document control (7.5) | Document controller | [DMS] | [Current + superseded 3 years] |
| Combined internal audit reports with findings tagged by standard | Clause 9.2 for each standard | Head of internal audit | [Audit repository] | [Certificate cycle + 3 years] |
| Integrated management review minutes | Clause 9.3 for each standard | CEO office | [Minutes repository] | [Certificate cycle + 3 years] |
| Corrective action log with standard tags | Clause 10 for each standard | IMS manager | [CAPA tool] | [Certificate cycle + 3 years] |
| CB proposals and audit programmes showing integrated audit time | Audit planning basis | IMS manager | [CB folder] | [Certificate cycle + 3 years] |

Set retention in the documented information register
(`isms/isms-documented-information-register`) and map evidence owners
in `isms/control-evidence-matrix`.

## 13. References

<!-- Guidance: Check editions before each review. ISO 9001 has a 2026 edition and ISO 22301 is under revision; the accreditation mandatory documents moved from IAF to Global ACI in 2026. -->

| Reference | Edition and status | Use |
|---|---|---|
| ISO/IEC 27001:2022 + Amd 1:2024 | Current (https://www.iso.org/standard/82875.html, Amd 1: https://www.iso.org/standard/88435.html) | ISMS requirements |
| ISO/IEC 27013:2021 + Amd 1:2024 | Current; Amd 1 published 2024-12-10 (https://www.iso.org/standard/78752.html) | Integrated implementation of 27001 and 20000-1 |
| ISO/IEC 20000-1:2018 + Amd 1:2024 | Current (cited without link) | Service management system requirements |
| ISO 9001:2026 | Published 2026-09-16 (cited without link) | Quality management system requirements |
| ISO 22301:2019 + Amd 1:2024 | Current; revision at committee draft stage (https://www.iso.org/standard/75106.html) | BCMS requirements |
| ISO/IEC 17021-1:2015 | Current (https://www.iso.org/standard/61651.html) | CB requirements, combined audits |
| ISO/IEC 27006-1:2024 | Current (https://www.iso.org/standard/82908.html) | ISMS audit time used in the integrated calculation |
| Global ACI-TECH-3-008 (M), application of ISO/IEC 17021-1 for audits of integrated management systems | Version 1.0, issued 2026-07-10, implementation 2026-08-28; based on IAF MD 11:2023 (check the Global ACI document for any changes) (https://global-aci.org/en/global_aci-documents/?cat_id=5) | Integrated audit time and reporting |
| Related templates | `compliance/iso-map`, `compliance/iso-20000-service-catalog`, `compliance/quality-policy`, `compliance/business-continuity`, `compliance/business-impact-analysis`, `compliance/internal-audit-program`, `compliance/management-review`, `compliance/controlled-document`, `compliance/capa-nonconformity`, `isms/isms-process-map`, `isms/isms-manual`, `isms/control-framework-crosswalk`, `isms/iso-27001-42001-integrated-soa`, `isms/certification-cycle-plan`, `isms/control-evidence-matrix` | Linked documents |

## Standard and licence note

Structure aligned with ISO/IEC 27013:2021 + Amd 1:2024, the common
management system structure used by ISO/IEC 27001:2022 + Amd 1:2024,
ISO/IEC 20000-1:2018 + Amd 1:2024, ISO 9001:2026 and ISO 22301:2019 +
Amd 1:2024, and the IMS audit mandatory document Global ACI-TECH-3-008
(based on IAF MD 11). The mapping, principles, tables and examples are
original; no text, tables or definitions from ISO, IEC, IAF or Global
ACI documents are reproduced, and clause topics are described in this
template's own words. Read the official standards before relying on
any mapping cell, and follow your certification body's procedures for
audit time. Check the current editions before use: ISO 9001 has a 2026
edition, ISO 22301 is under revision, and the accreditation mandatory
documents were renumbered under Global ACI in 2026. Official ISO text,
purchase or licensed access: https://www.iso.org/standard/78752.html,
https://www.iso.org/standard/82875.html and
https://www.iso.org/standard/75106.html.

Template licence: MIT.