ISO/IEC 27013:2021/PRF Amd 1

Information security, cybersecurity and privacy protection — Guidance on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1 — Amendment 1

Sécurité de l'information, cybersécurité et protection de la vie privée — Recommandations pour la mise en œuvre intégrée de l'ISO/IEC 27001 et de l'ISO/IEC 20000-1 — Amendement 1

General Information

• Status: Not Published
• ICS: 03.080.99 - Other services
• ICS: 03.100.70 - Management systems
• ICS: 35.020 - Information technology (IT) in general
• ICS: 35.030 - IT Security
• Technical Committee: ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
• Drafting Committee: ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
• Current Stage: 5020 - FDIS ballot initiated: 2 months. Proof sent to secretariat
• Completion Date: 15-Oct-2024

Relations

• Amends: ISO/IEC 27013:2021 - Information security, cybersecurity and privacy protection — Guidance on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1
• Effective Date: 29-Oct-2022

Standards Content (Sample)

International
Standard
ISO/IEC 27013
Third edition
Information security, cybersecurity
2021-11
and privacy protection — Guidance
on the integrated implementation of
AMENDMENT 1
ISO/IEC 27001 and ISO/IEC 20000-1
AMENDMENT 1
Sécurité de l'information, cybersécurité et protection de la vie
privée — Recommandations pour la mise en œuvre intégrée de
l'ISO/IEC 27001 et de l'ISO/IEC 20000-1
AMENDEMENT 1
PROOF/ÉPREUVE
Reference number
ISO/IEC 27013/Amd. 1:2024(en) © ISO/IEC 2024

ISO/IEC 27013/Amd. 1:2024(en)
© ISO/IEC 2024
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
PROOF/ÉPREUVE
© ISO/IEC 2024 – All rights reserved
ii
ISO/IEC 27013/Amd. 1:2024(en)
Information security, cybersecurity and privacy protection —
Guidance on the integrated implementation of ISO/IEC 27001
and ISO/IEC 20000-1
AMENDMENT 1
2  Normative references
Replace reference to ISO/IEC 27001 with the following:
ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security
management systems — Requirements
Also replace all references to ISO/IEC 27001:2013 throughout the text of the document with
ISO/IEC 27001:2022.
4.2  ISO/IEC 27001 concepts
nd
Replace the last sentence of the 2 paragraph with the following:
Examples of requirements relevant to interested parties include business requirements, legal and regulatory
requirements and contractual obligations.
Replace the reference to ISO/IEC 27001:2013 with ISO/IEC 27001:2022.

4.4  Similarities and differences
Replace the third paragraph with the following:
See Annex A for details of the correspondence between ISO/IEC 27001:2022, Clauses 1 to 10, and
ISO/IEC 20000-1:2018, Clauses 1 to 10. See Annex B for a comparison of terms and definitions between
ISO/IEC 27000 and ISO/IEC 20000-1.

6.2.1  Requirements and controls
Replace the entire subclause with the following:
ISO/IEC 27001:2022, Clauses 4 to 10, specifies requirements for an ISMS. In addition, ISO/IEC 27001:2022,
Annex A, contains an extensive list of controls. The controls in ISO/IEC 27001:2022, Annex A, are not
requirements and are not mandatory. ISO/IEC 27001:2022, 6.1.3, specifies that the organization defines and
applies an information security risk treatment process to determine all controls necessary to implement
information security risk treatment options chosen and then compare the necessary controls with those in
ISO/IEC 27001:2022, Annex A, and verify that no necessary controls have been omitted. The statement of
applicability (SoA) is then used to record which controls are relevant to the organization’s ISMS. The controls
listed in ISO/IEC 27001:2022, Annex A, are not exhaustive and can be substituted with others, or additional
controls can be added as needed. This means it is possible for the organization’s SoA to:
a) include only a subset of the controls in ISO/IEC 27001:2022, Annex A;
PROOF/ÉPREUVE
© ISO/IEC 2024 – All rights reserved
ISO/IEC 27013/Amd. 1:2024(en)
b) not include any of the ISO/IEC 27001:2022, Annex A, controls;
c) include alternative controls;
d) include a combination of controls from ISO/IEC 27001:2022, Annex A, and other sources.
Any control within ISO/IEC 27001:2022, Annex A, that would not modify one or more unacceptable risks,
is unnecessary for the organization. Similarly, controls not included in ISO/IEC 27001:2022, Annex A, can
be determined as necessary to modify risk. Organizations can design controls as required or identify them
from any source.
ISO/IEC 20000-1 specifies requirements for the SMS but does not list any controls and does not specify a
requirement for a Statement of Applicability, so there is no direct correlation between ISO/IEC 27001:2022,
Annex A, and ISO/IEC 20000-1. However, ISO/IEC 20000-1:2018, 8.7.3.2, includes a requirement to determine
controls to address information security risks to the SMS and the services, and to document the decisions
about these controls. In addition, there is a requirement to monitor and review the effectiveness of these
controls, and to take action if required.
Organizations wishing to integrate an ISMS and an SMS should distinguish between the requirements
specified in ISO/IEC 27001 and ISO/IEC 20000-1, and the information security controls specified in
ISO/IEC 27001:2022, Annex A. Even if it appears that there is a common topic area between a requirement
specified in ISO/IEC 20000-1 and a control included in ISO/IEC 27001:2022, Annex A, the distinction
between requirements and controls should be understood and communicated to avoid confusion within the
organization.
6.2.2   Assets and configuration items
Replace the reference to ISO/IEC 27001:2013 with ISO/IEC 27001:2022.
Add the following as a new final paragraph to 6.2.2:
ISO/IEC 27001:2022, Annex A includes control 8.9 for "configuration management". This term is also used in
ISO/IEC 20000-1, but not in the same sense, so care should be taken to not assume any relationship
...

Formatted: Centered
DRAFT AMENDMENT
Style Definition: Heading 1
Style Definition: Heading 2
ISO/IEC 27013:2021/DAM/Amd. 1:2023(E2024(en)
Style Definition: Heading 3
Style Definition: Heading 4
ISO/IEC JTC 1/SC 27
Style Definition: Heading 5
Secretariat: DIN
Style Definition: Heading 6
Style Definition: ANNEX
Date: 2023-07-202024-10-15
Style Definition: AMEND Terms Heading
Information security, cybersecurity and privacy protection — Guidance on the integrated
Style Definition: AMEND Heading 1 Unnumbered
implementation of ISO/IEC 27001 and ISO/IEC 20000-1
Style Definition: zzCopyright
AMENDMENT 1 Style Definition: zzSTDTitle: Font: Cambria, 14 pt, Font
color: Blue, Left
Sécurité de l'information, cybersécurité et protection de la vie privée — Recommandations pour la
Style Definition: zzCover: Font: Cambria, Right
mise en oeuvre intégrée de l'ISO/IEC 27001 et de l'ISO/IEC 20000-1
Formatted
Formatted: Font: 11 pt, French (Switzerland)
AMENDEMENT 1
Formatted: Left
Formatted: Font: 11 pt, French (Switzerland)
Formatted: Font: 11 pt, French (Switzerland)
Formatted: Font: 11 pt, Font color: Auto, French
(Switzerland)
Formatted: Font: 11 pt, Font color: Auto
Formatted: Font: 11 pt, Font color: Auto
Formatted: Font: 11 pt
Formatted: Font: 11 pt
Formatted: Font: 11 pt
Formatted: Font: Italic
Formatted: Font: Italic
Formatted: Centered
ISO/IEC 27013:2021/DAM 1:2023(E)
Formatted: Font: Not Bold
© ISO/IEC 2023 2024
Formatted
Formatted: Default Paragraph Font
All rights reserved. Unless otherwise specified, or required in the context of its
implementation, no part of this publication may be reproduced or utilized otherwise in any
form or by any means, electronic or mechanical, including photocopying, or posting on the
internet or an intranet, without prior written permission. Permission can be requested
from either ISO at the address below or ISO’sISO's member body in the country of the
requester.
ISO copyright officeCopyright Office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Formatted: Adjust space between Latin and Asian text,
Adjust space between Asian text and numbers
Phone: + 41 22 749 01 11
Email: [e-mail]
Email: [e-mail]
Website: www.iso.orgwww.iso.org
Formatted: English (United Kingdom)
Published in Switzerland. Formatted: Adjust space between Latin and Asian text,
Adjust space between Asian text and numbers
Formatted: English (United Kingdom)
Formatted: English (United Kingdom)
ii © ISO/IEC 2023 – All rights reserved

ISO/IEC 27013:2021/DAM/Amd. 1:2023(E2024(en)
Formatted: Centered
Formatted: Font: Not Bold
Formatted: Space Before: 0 pt, Line spacing: single,
Information security, cybersecurity and privacy protection —
Hyphenate
Guidance on the integrated implementation of ISO/IEC 27001 and
ISO/IEC 20000-1
AMENDMENT 1
2  Normative references
Replace reference to ISO/IEC 27001 with the following:
ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information
security management systems — Requirements
Also replace all references to ISO/IEC 27001:2013 throughout the text of the document with
ISO/IEC 27001:2022.
4.2  ISO/IEC 27001 concepts
nd
Replace the last sentence of the 2 paragraph with the following:
Examples of requirements relevant to interested parties include business requirements, legal and
regulatory requirements and contractual obligations.
Replace the reference to ISO/IEC 27001:2013 with ISO/IEC 27001:2022.

4.4  Similarities and differences
Replace the third paragraph with the following:
See Annex A for details of the correspondence between ISO/IEC 27001:2022, Clauses 1 to 10, and
ISO/IEC 20000-1:2018, Clauses 1 to 10. See Annex B for a comparison of terms and definitions
between ISO/IEC 27000 and ISO/IEC 20000-1.

6.2.1  Requirements and controls
Replace 6.2.1the entire subclause with the following:
ISO/IEC 27001:2022, Clauses 4 to 10, specifies requirements for an ISMS. In addition, ISO/IEC
27001:2022, Annex A, contains an extensive list of controls. The controls in ISO/IEC 27001:2022,
Annex A, are not requirements and are not mandatory. ISO/IEC 27001:2022, 6.1.3, specifies that
the organization defines and applies an information security risk treatment process to determine
all controls necessary to implement information security risk treatment options chosen and then
compare the necessary controls with those in ISO/IEC 27001:2022, Annex A, and verify that no
necessary controls have been omitted. The statement of applicability (SoA) is then used to record
which controls are relevant to the organization’s ISMS. The controls listed in ISO/IEC
27001:2022, Annex A, are not exhaustive and can be substituted with others, or additional
controls can be added as needed. This means it is possible for the organization’s SoA to:
Formatted: Normal, Centered, Space After: 24 pt, Tab
a) include only a subset of the controls in ISO/IEC 27001:2022, Annex A;
stops: 17.2 cm, Right
© ISO/IEC 2023 – All rights reserved 1
© ISO/IEC 2024 – All rights reserved
ISO/IEC 27013:2021/DAM 1:2023(E)
Formatted: Font: Not Bold
b) not include any of the ISO/IEC 27001:2022, Annex A, controls;
c) include alternative controls;
d) include a combination of controls from ISO/IEC 27001:2022, Annex A, and other sources.
Any control within ISO/IEC 27001:2022, Annex A, that would not modify one or more
unacceptable risks, is unnecessary for the organization. Similarly, controls not included in
ISO/IEC 27001:2022, Annex A, can be determined as necessary to modify risk. Organizations can
design controls as required or identify them from any source.
ISO/IEC 20000-1 specifies requirements for the SMS but does not list any controls and does not
specify a requirement for a Statement of Applicability, so there is no direct correlation between
ISO/IEC 27001:2022, Annex A, and ISO/IEC 20000-1. However, ISO/IEC 20000-1:2018, 8.7.3.2,
includes a requirement to determine controls to address information security risks to the SMS
and the services, and to document the decisions about these controls. In addition, there is a
requirement to monitor and review the effectiveness of these controls, takingand to take action
if required.
Organizations wishing to integrate an ISMS and an SMS should distinguish between the
requirements specified in ISO/IEC 27001 and ISO/IEC 20000-1, and the information security
controls specified in ISO/IEC 27001:2022, Annex A. Even if it appears that there is a common
topic area between a requirement specified in ISO/IEC 20000-1 and a control included in ISO/IEC
27001:2022, Annex A, the distinction between requirements and controls should be understood
and communicated to avoid confusion within the organization.
Remove the following sentence:
Annex B of this document provides a comparison of topics between the requirements specified in
ISO/IEC 2
...