The relationship between information security management and service management is so close that many organizations already recognise the benefits of adopting the two International Standards for these domains: ISO/IEC 27001 for information security management and ISO/IEC 20000-1 for service management. It is common for an organization to improve the way it operates to achieve conformity with the requirements specified in one of these International Standards and then make further improvements to achieve conformity with the requirements of the other.
There are a number of advantages to implementing an integrated management system that takes into account not only the services provided but also the protection of information. These benefits can be experienced whether one International Standard is implemented before the other or both International Standards are implemented simultaneously. Management and organizational processes, in particular, can derive benefit from the mutually reinforcing concepts and similarities between these International Standards and their common objectives.
Key benefits of an integrated implementation of information security management and service management include the following:
a) the credibility, to internal or external customers of the organization, of an effective and secure service;
b) the lower cost of an integrated program of two projects, where effective and efficient management of both services and information security are part of an organization’s strategy;
c) a reduction in implementation time due to the integrated software development of processes common to both standards;
d) better communication, reduced cost and improved operational efficiency through the elimination of unnecessary duplication;
e) a greater understanding by service management and security personnel of each others’ viewpoints;
f) an organization certified for ISO/IEC 27001 can more easily fulfil the requirements for information security specified in ISO/IEC 20000-1:2011, 6.6, as both International Standards are complementary in requirements.
The guidance in this International Standard is based upon the published versions of both ISO/IEC 27001 and ISO/IEC 20000-1.
This International Standard is intended for use by persons with knowledge of both, either or neither of the International Standards ISO/IEC 27001 and ISO/IEC 20000-1.
It is expected that all readers have access to copies of both ISO/IEC 27001 and ISO/IEC 20000-1. Consequently, this International Standard does not reproduce parts of either of those International Standards. Equally, it does not describe all parts of each International Standard comprehensively. Only those parts where subject matter overlaps are described in detail.
This International Standard does not provide guidance associated with the various legislation and regulations outside the control of the organization. These can vary by country and impact the planning of an organization’s management system.
