ISO/IEC DIS 27013

Information security, cybersecurity and privacy protection -- Guidance on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1

Titre manque

Standards Content (sample)

DRAFT INTERNATIONAL STANDARD
ISO/IEC DIS 27013
ISO/IEC JTC 1/SC 27 Secretariat: DIN
Voting begins on: Voting terminates on:
2020-12-21 2021-03-15
Information security, cybersecurity and privacy
protection — Guidance on the integrated implementation
of ISO/IEC 27001 and ISO/IEC 20000-1
ICS: 03.080.99; 35.020; 03.100.70; 35.030
THIS DOCUMENT IS A DRAFT CIRCULATED
FOR COMMENT AND APPROVAL. IT IS
THEREFORE SUBJECT TO CHANGE AND MAY
NOT BE REFERRED TO AS AN INTERNATIONAL
STANDARD UNTIL PUBLISHED AS SUCH.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL,
This document is circulated as received from the committee secretariat.
TECHNOLOGICAL, COMMERCIAL AND
USER PURPOSES, DRAFT INTERNATIONAL
STANDARDS MAY ON OCCASION HAVE TO
BE CONSIDERED IN THE LIGHT OF THEIR
POTENTIAL TO BECOME STANDARDS TO
WHICH REFERENCE MAY BE MADE IN
Reference number
NATIONAL REGULATIONS.
ISO/IEC DIS 27013:2020(E)
RECIPIENTS OF THIS DRAFT ARE INVITED
TO SUBMIT, WITH THEIR COMMENTS,
NOTIFICATION OF ANY RELEVANT PATENT
RIGHTS OF WHICH THEY ARE AWARE AND TO
PROVIDE SUPPORTING DOCUMENTATION. ISO/IEC 2020
---------------------- Page: 1 ----------------------
ISO/IEC DIS 27013:2020(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2020

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may

be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting

on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address

below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
ii © ISO/IEC 2020 – All rights reserved
---------------------- Page: 2 ----------------------
ISO/IEC DIS 27013:2020(E)
Contents Page

Foreword ........................................................................................................................................................................................................................................iv

Introduction ..................................................................................................................................................................................................................................v

1 Scope ................................................................................................................................................................................................................................. 1

2 Normative references ...................................................................................................................................................................................... 1

3 Terms, definitions and abbreviated terms ................................................................................................................................ 1

4 Overviews of ISO/IEC 27001 and ISO/IEC 20000-1 .......................................................................................................... 2

4.1 Understanding the International Standards ................................................................................................................. 2

4.2 ISO/IEC 27001 concepts ................................................................................................................................................................. 2

4.3 ISO/IEC 20000-1 concepts ........................................................................................................................................................... 2

4.4 Similarities and differences ......................................................................................................................................................... 2

5 Approaches for integrated implementation ............................................................................................................................ 3

5.1 General ........................................................................................................................................................................................................... 3

5.2 Considerations of scope .................................................................................................................................................................. 4

5.3 Pre-implementation scenarios .................................................................................................................................................. 4

5.3.1 General...................................................................................................................................................................................... 4

5.3.2 Neither standard is currently used as the basis for a management system ................. 4

5.3.3 The management system fulfils the requirements of one of the standards ................. 5

5.3.4 Separate management systems exist which fulfil the requirements of each

standard .................................................................................................................................................................................. 6

6 Integrated implementation considerations ............................................................................................................................. 7

6.1 General ........................................................................................................................................................................................................... 7

6.2 Potential challenges ............................................................................................................................................................................ 7

6.2.1 Requirements and controls .................................................................................................................................... 7

6.2.2 Assets and configuration items ........................................................................................................................... 8

6.2.3 Service design and transition ............................................................................................................................... 9

6.2.4 Risk assessment and management .................................................................................................................. 9

6.2.5 Risk and other parties ..............................................................................................................................................10

6.2.6 Incident management ........................................................................................................................................... ....10

6.2.7 Problem management ..............................................................................................................................................11

6.2.8 Gathering of evidence ...............................................................................................................................................12

6.2.9 Major incident management ...............................................................................................................................12

6.2.10 Classification and escalation of incidents................................................................................................12

6.2.11 Change management .................................................................................................................................................13

6.3 Potential gains ......................................................................................................................................................................................13

6.3.1 Service level management and reporting ................................................................................................13

6.3.2 Management commitment and continual improvement ...........................................................13

6.3.3 Capacity management ..............................................................................................................................................14

6.3.4 Management of third parties and related risk ....................................................................................14

6.3.5 Continuity and availability management .................................................................................................15

6.3.6 Release and deployment management ......................................................................................................15

Annex A (informative) Correspondence between ISO/IEC 27001 and ISO/IEC 20000-1

for Clauses 1-10 ..................................................................................................................................................................................................16

Annex B (informative) Correspondence between the controls in Annex A of ISO/IEC 27001

and the requirements in ISO/IEC 20000-1 .............................................................................................................................18

Annex C (informative) Comparison of terms and definitions between ISO/IEC 27000

and ISO/IEC 20000-1 .....................................................................................................................................................................................21

Bibliography .............................................................................................................................................................................................................................55

© ISO/IEC 2020 – All rights reserved iii
---------------------- Page: 3 ----------------------
ISO/IEC DIS 27013:2020(E)
Foreword

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical

Commission) form the specialized system for worldwide standardization. National bodies that are

members of ISO or IEC participate in the development of International Standards through technical

committees established by the respective organization to deal with particular fields of technical

activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international

organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the

work. In the field of information technology, ISO and IEC have established a joint technical committee,

ISO/IEC JTC 1.

The procedures used to develop this document and those intended for its further maintenance are

described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for

the different types of document should be noted. This document was drafted in accordance with the

editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/ directives).

Attention is drawn to the possibility that some of the elements of this document may be the subject

of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent

rights. Details of any patent rights identified during the development of the document will be in the

Introduction and/or on the ISO list of patent declarations received (see www .iso .org/ patents).

Any trade name used in this document is information given for the convenience of users and does not

constitute an endorsement.

For an explanation on the meaning of ISO specific terms and expressions related to conformity

assessment, as well as information about ISO's adherence to the WTO principles in the Technical

Barriers to Trade (TBT) see the following URL: Foreword - Supplementary information

The committee responsible for this document is ISO/IEC JTC 1, Information technology, Subcommittee

SC 27, Information security, cybersecurity and privacy protection.

This third edition cancels and replaces the second edition (ISO/IEC 27013:2015), which has been

technically revised. The changes made are to update the document to align with the third edition of

ISO/IEC 20000-1.
iv © ISO/IEC 2020 – All rights reserved
---------------------- Page: 4 ----------------------
ISO/IEC DIS 27013:2020(E)
Introduction

The relationship between information security management and service management is so close that

many organizations already recognise the benefits of adopting the two International Standards for

these domains: ISO/IEC 27001 for information security management and ISO/IEC 20000-1 for service

management. It is common for an organization to improve the way it operates to achieve conformity

with the requirements specified in one International Standard and then make further improvements to

achieve conformity with the requirements of another.

There are a number of advantages for an organization in ensuring its management system takes into

account both the service lifecycle and the protection of the organization’s information. These benefits

can be experienced whether one International Standard is implemented before the other, or both

International Standards are implemented simultaneously. Management and organizational processes,

in particular, can derive benefit from the mutually reinforcing concepts and similarities between these

International Standards and their common objectives.

Key benefits of an integrated implementation of information security management and service

management include the following:

a) credibility, to internal and external customers and other interested parties of the organization, of

an effective and secure service;

b) lower cost of implementing, maintaining and auditing an integrated management system, where

effective and efficient management of both services and information security are part of an

organization’s strategy;

c) reduction in implementation time due to the integrated development of processes common to both

standards;

d) better communication, increased reliability and improved operational efficiency through

elimination of unnecessary duplication;

e) a greater understanding by service management and information security personnel of each other’s

viewpoints;

f) an organization certified for ISO/IEC 27001 can more easily fulfil the requirements for information

security specified in ISO/IEC 20000-1, 8.7.3, as both International Standards are complementary in

requirements.
The guidance in this International Standard is based upon ISO/IEC 27001:2013 and
ISO/IEC 20000-1:2018.

This International Standard is intended for use by persons who intend to integrate ISO/IEC 27001 and

ISO/IEC 20000-1, who are familiar with both, either or neither of those International Standards.

This International Standard does not reproduce content of ISO/IEC 27001 or ISO/IEC 20000-1. Equally,

it does not describe all parts of each International Standard comprehensively. Only those parts where

subject matter overlaps or differs are described in detail. It is assumed that users of this document have

access to ISO/IEC 20000-1 and ISO/IEC 27001.

This International Standard does not provide guidance associated with the various legislation and

regulations outside the control of the organization. These can vary by country and impact the planning

of an organization’s management system.
© ISO/IEC 2020 – All rights reserved v
---------------------- Page: 5 ----------------------
DRAFT INTERNATIONAL STANDARD ISO/IEC DIS 27013:2020(E)
Information security, cybersecurity and privacy
protection — Guidance on the integrated implementation
of ISO/IEC 27001 and ISO/IEC 20000-1
1 Scope

This document provides guidance on the integrated implementation of ISO/IEC 27001 and

ISO/IEC 20000-1 for those organizations that are intending to either

a) implement ISO/IEC 27001 when ISO/IEC 20000-1 is already implemented, or vice versa,

b) implement both ISO/IEC 27001 and ISO/IEC 20000-1 together, or

c) integrate existing management systems based on ISO/IEC 27001 and ISO/IEC 20000-1.

This document focuses exclusively on the integrated implementation of an information security

management system (ISMS) as specified in ISO/IEC 27001 and a service management system (SMS) as

specified in ISO/IEC 20000-1. In practice, ISO/IEC 27001 and ISO/IEC 20000-1 can also be integrated

with other management system standards, such as ISO 9001 and ISO 14001.

Annex A of this document provides a comparison of content at a clause level between ISO/IEC 27001

and ISO/IEC 20000-1.

Annex B of this document provides a comparison of topics between the requirements specified in

ISO/IEC 20000-1 and the controls in ISO/IEC 27001, Annex A.
Annex C of this document provides a comparison of:

— terms defined in ISO/IEC 27000, the glossary for the ISO/IEC 27000 family of standards;

— terms defined or used in ISO/IEC 20000-1.
2 Normative references

The following documents are referred to in the text in such a way that some or all of their content

constitutes requirements of this document. For dated references, only the edition cited applies. For

undated references, the latest edition of the referenced document (including any amendments) applies.

ISO/IEC 20000-1:2018, Information technology — Service management — Part 1: Service management

system requirements

ISO/IEC 27000:2018, Information technology — Security techniques — Information security management

systems — Overview and vocabulary

ISO/IEC 27001:2013, Information technology — Security techniques — Information security management

systems — Requirements
3 Terms, definitions and abbreviated terms

For the purposes of this document, the terms and definitions given in ISO/IEC 27000 and

ISO/IEC 20000-1 apply.

ISO and IEC maintain terminological databases for use in standardization at the following addresses:

— ISO Online browsing platform: available at https: //www .iso .org/obp
© ISO/IEC 2020 – All rights reserved 1
---------------------- Page: 6 ----------------------
ISO/IEC DIS 27013:2020(E)
— IEC Electropedia: available at http: //www .electropedia .org/
The following abbreviations apply.
ISMS information security management system (from ISO/IEC 27001)
SMS service management system (from ISO/IEC 20000-1)
4 Overviews of ISO/IEC 27001 and ISO/IEC 20000-1
4.1 Understanding the International Standards

An organization should have a good understanding of the characteristics, similarities and differences of

ISO/IEC 27001 and ISO/IEC 20000-1 before planning an integrated management system for information

security management and service management. This maximizes the time and resources available for

implementation. Clauses 4.2 to 4.4 of this document provide an introduction to the main concepts

underlying both International Standards but should not be used as a substitute for a detailed review.

4.2 ISO/IEC 27001 concepts

ISO/IEC 27001 provides a model for establishing, implementing, maintaining and continually improving

an ISMS to protect information. Information can take any form, be stored in any way and be used for

any purpose by, or within, the organization.

To achieve conformity with the requirements specified in ISO/IEC 27001, an organization should

implement an ISMS based on a risk assessment process. As part of a risk treatment process, the

organization should select, implement, monitor and review a variety of measures to manage identified

risks. These measures are known as information security controls. The organization should determine

acceptable levels of risk, taking into account the requirements of interested parties relevant to

information security. Examples of requirements are business requirements, legal and regulatory

requirements or contractual obligations.

ISO/IEC 27001 can be used by any type and size of organization. Excluding any of the requirements

specified in Clauses 4 to 10 is not acceptable when an organization claims conformity to ISO/IEC 27001.

4.3 ISO/IEC 20000-1 concepts

ISO/IEC 20000-1 specifies requirements for establishing, implementing, maintaining and continually

improving an SMS. An SMS supports the management of the service lifecycle, including the planning,

design, transition, delivery and improvement of services, which meet agreed requirements and deliver

value for customers, users and the organization delivering the services.

Some of the requirements specified in ISO/IEC 20000-1 are grouped into clauses indicating processes,

such as incident management, change management and supplier management. Some requirements for

information security management are specified in ISO/IEC 20000-1, 8.7.3. All requirements specified

in ISO/IEC 20000-1 are generic and are intended to be applicable to all organizations, regardless of

the organization’s type or size, or the nature of the services delivered. ISO/IEC 20000-1 is intended for

management of services using technology and digital information. Exclusion of any of the requirements

in ISO/IEC 20000-1, Clauses 4 to 10, is not acceptable when the organization claims conformity to

ISO/IEC 20000-1, irrespective of the nature of the organization.
4.4 Similarities and differences

Service management and information security management are often treated as if they are neither

connected nor interdependent. The context for such separation is that service management can easily

be related to efficiency, service quality, customer satisfaction and profitability, while information

security management is often not understood to be fundamental to effective service delivery. As a

2 © ISO/IEC 2020 – All rights reserved
---------------------- Page: 7 ----------------------
ISO/IEC DIS 27013:2020(E)

result, service management is frequently implemented first. There are some shared concepts between

these two standards, as well as concepts that are unique to each.

Information security management and service management clearly address very similar requirements

and activities, even though the SMS and the ISMS each highlight different details. When working with

the two standards, it should be understood that their characteristics differ in more than one aspect. For

example, their scopes can differ (see 5.2). They also have different goals. ISO/IEC 20000-1 is designed

to ensure that the organization provides effective services, while ISO/IEC 27001 is designed to enable

the organization to manage information security risk and recover from or prevent information security

incidents.

See Annex A of this document for details of the correspondence between ISO/IEC 27001 and

ISO/IEC 20000-1 for Clauses 1 - 10. See Annex B of this document for details of the comparison between

the controls in Annex A of ISO/IEC 27001 and the requirements in ISO/IEC 20000-1.

5 Approaches for integrated implementation
5.1 General

An organization planning to implement both ISO/IEC 27001 and ISO/IEC 20000-1 can be in one of three

states as follows:

— unofficial management arrangements exist which cover both information security management

and service management but have not been formalised, documented or deliberately integrated into

the organization’s other activities;

— there is a management system based upon one of these two International Standards;

— there are separate management systems based on the two International Standards, but these are

not integrated.

An organization planning to implement an integrated management system for information security and

service management should consider at least the following:
a) other management system(s) already in use (e.g. a quality management system);
b) the scope(s) of the proposed ISMS and SMS;

c) all services, processes and their interdependencies in the context of the integrated management

system;
d) elements of each standard which can be merged and how they can be merged;
e) elements that are to remain separate;

f) the impact of the integrated management system on customers, suppliers and other interested

parties;
g) the impact on technology in use;
h) the impact on, or risk to, services and service management;

i) the impact on, or risk to, information security and information security management;

j) education and training in the integrated management system;
k) accountabilities and responsibilities for all requirements;
l) phases and sequence of implementation activities.
© ISO/IEC 2020 – All rights reserved 3
---------------------- Page: 8 ----------------------
ISO/IEC DIS 27013:2020(E)
5.2 Considerations of scope

One area where the two International Standards can differ is on the subject of scope, namely, what

assets, services, processes and parts of the organization the management system should include.

ISO/IEC 20000-1 is concerned with the planning, design, transition, delivery and improvement of

services to deliver value to customers, users and the organization. The scope of ISO/IEC 20000-1

includes those parts of the activities that deliver services. The scope of an SMS can include all or some

of the services delivered by the organization. The organization in the scope of the SMS can be a whole

or part of a larger entity. The SMS scope may also be defined exclusively by a clear physical boundary,

such as a single site delivering services. The organization in the scope of the SMS can also be known as

a service provider.

ISO/IEC 27001 is concerned with how to manage information security risk. The scope of the ISMS covers

those activities related to managing the confidentiality, integrity and availability of the organization’s

information.

For ISO/IEC 27001, the definition of the organization is that which is covered by the ISMS. As with

an SMS, an ISMS can be applied to part or all of an entity and can include services delivered by the

organization. The ISMS scope may also be defined exclusively by a clear physical boundary, such as a

security perimeter.

In some cases, the full requirements of the two International Standards cannot be implemented for

all, or even part, of the organization's activities. This can be the case if, for example, an organization

cannot conform to the requirements specified in ISO/IEC 20000-1 because other parties provide or

operate all the services, service components or processes in the scope of the SMS. ISO/IEC 20000-1,

8.2.3 states that not all services, service components and processes can be provided by other parties –

the organization itself should provide at least some of these.

An organization can implement an SMS and an ISMS with some overlap between the different scopes.

Where activities lie within the scope of both ISO/IEC 27001 and ISO/IEC 20000-1, the integrated

management system should take both International Standards into consideration (see Annex A).

Differences in scope can result in some services included in the SMS being excluded from the scope

of the ISMS. Equally, the SMS can exclude processes and functions of the ISMS. For example, some

organizations choose to implement an ISMS only in their operation and communication functions,

while application management services are included in their SMS but not in the ISMS. Alternatively, the

ISMS can cover all the services, while the SMS can cover only the services for a particular customer or

some services for all customers. The organization should align the scopes of the management systems

as much as possible to ensure successful integration and to maximize the benefits of the integrated

management system.

NOTE Guidance on scope definition for ISO/IEC 20000-1 is available in ISO/IEC 20000-3. Guidance on the

scope definition for ISO/IEC 27001 is available in ISO/IEC 27003.
5.3 Pre-implementation scenarios
5.3.1 General

An organization planning an integrated management system can be in one of three states, as described

in 5.3.2 to 5.3.4 of this document. In all cases, the organization has some form of management processes

or it would not exist. 5.3.2, 5.3.3 and 5.3.4 of this document provide suggestions for implementation in

each of the three states described in 5.1.
5.3.2 Neither standard is currently used as the basis for a management system

It is easy to assume that, where neither an ISMS or an SMS is implemented, there are no policies,

processes and procedures and that therefore the situation is simple to deal with. However, this is a

misconception.
4 © ISO/IEC 2020 – All rights reserved
---------------------- Page: 9 ----------------------
ISO/IEC DIS 27013:2020(E)

All organizations have some form of management system, which may simply be its processes, plans

and policies. This should be adapted to achieve conformity with the requirements specified in either or

both of the standards.

The decision regarding the order in which the requirements for the ISMS and the SMS will be

implemented should be based on business needs and priorities. Decisions can be influenced by the

primary driver, for example competitive positioning or the need to demonstrate conformity to a

customer.

Another important decision is whether to implement both an SMS and an ISMS concurrently or

sequentially. If the implementation is sequential, either the ISMS or the SMS is implemented and then

that management system is extended to include the additional requirements of the other. Both an

ISMS and an SMS can be implemented concurrently, if implementation activities and efforts can be

coordinated and duplication minimised. However, depending upon the nature of the organization, it can

be prudent to start with the requirements specified in one standard and then expand the management

system to include the requirements of the other.
These considerations are illustrated in the following scenarios:
Scenario 1: An organization that provides services should
...