Strahinja Stojanovic
September 27, 2016
Update 2022-05-03.
ISO 27001 is one of the most popular standards in the world, and I see many companies have a need for information security with increased use of information technology, clouds, etc. If you already have implemented ISO 9001 and want to implement ISO 27001, or you plan to implement both standards at once, the best approach is to create an Integrated Management System (IMS) that will meet the requirements of both standards. This will save you a great amount of time in the implementation, and it will also decrease the effort of maintaining the system and achieving continual compliance with both standards.
The key for saving time and effort is good planning. Your implementation project should be based not only on the current state of your organization, in terms of compliance with the requirements of these two standards, but also on spotting shortcuts and low-hanging fruit. Some of the most important places where you can speed up the implementation are the following common requirements of both standards:
With all of these common elements, it would seem logical to maintain one system for each common element. Keep in mind that although some requirements seem the same and can be covered with the same process, that doesn’t mean they will have the same results for both standards. The focus of ISO 9001 is on quality products and services and customer satisfaction, while ISO 27001 is focused on information security; therefore, the results of the management review as well as the inputs will be different, and the same goes for most of the above-mentioned common clauses.
The differences between the standards usefully supplement each other, which decisively contribute to increasing business success: information security secures the company’s potential, and quality management creates it. After addressing the common requirements of the standards, the company must deal with their differences that are mostly present in clauses 6 and 8. ISO 27001 adds the following into the IMS:
By integrating the two management systems, there are many synergies that allow for combined resources to save time and money on maintaining and improving the management system.
With a holistic management system approach that embodies international best practice, organizations can demonstrate compliance with both the ISO 27001 and ISO 9001 standards to customers, certification bodies, and regulatory authorities. In addition, by integrating the management of quality and information security, organizations can demonstrate both the quality and security of their processes, as well as achieve significant competitive advantage through improved organizational performance, reduced risk, better customer satisfaction, and enhanced reputation and marketability.
To automate your compliance with ISO 27001, sign up for a 14-day free trial of Conformio, the leading ISO 27001 compliance software.