ISO27001 and ISO9001 Integration

Valb · Newbie Joined: Apr 27, 2006 Posts: 1 Location: London, UK

Does anyone have any experience of integrating a Quality Management System (QMS) and an Information Security Management System (ISMS)?

We have a QMS accredited to 9001 and are developing an ISMS, which will hopefully get accredited to 27001 in due course. We are unsure what the best course of action is: keep going with the ISMS, get it accredited and then try and link the two systems later on or start linking them now?

Any pointers would be gratefully received Smile

V.

Gazzil · Newbie Joined: Jul 08, 2005 Posts: 5

Hi mate,

Prior to going for ISO27001 we too had ISO9001 and 14001 and I decided the best course of action was to develop an Integrated system consisting of all three.

Its a lot of work, but I found that a lot of the issues could be merged together such as review meetings, audits, training topics, incident management, document control and an overall document register.

Also, just little things like to do lists and review dates etc were a lot easier to manage this way.

The only real problem, is like me, you'll be pushed to find an auditor or assessor who can do all three standards, but if you have a clear system that shouldn't be a problem for an auditor to navigate through your ISMS.

Hope this helps,

Gaz

cbauer · Newbie Joined: Jun 06, 2006 Posts: 1

We also have the ISO 9001 and may look into 27001. Does anyone have any type of "mapping" for these two standards?

Thanks for any pointers!
Christine

Biljana · Newbie Joined: Jun 23, 2005 Posts: 20

There is mapping table at the end of ISO 27001 standard, for both ISO 9001 and 14001.

If you already have ISO 9001, you can easily use the same boundaries of ISMS as where you implemented ISO 9001 (that's also recommended by ISO 27001), you can use existing document and records control procedures, internal audit procedures, forms of documents, monitoring and measurement procedures, corrective and preventive actions...

ALB · Newbie Joined: Jul 26, 2006 Posts: 2

You can also look into ISO 20000 which is the integrated management system standard.

Calvin · Newbie Joined: Aug 30, 2005 Posts: 39

ISO 20000 is more concerned with IT Service Management (formerly BS15000) rather then Information Security (ISO27001) or quality.


Create an account	Home · Topics · Downloads · Your Account · Submit News · Top 10


The ISO 17799 Implementation Forum: A BS7799 / ISO27001, ISO17799 and ISO 27000 User Group All logos and trademarks are property of their respective owner. Comments are property of their posters. The rest © 2005 ISO17799 / ISO 27002 Forum AKA: BS 7799, SPE 20003, SS 627799, JIS X 5080, AS/NZS 4444, ISO 27001. Other links: UKAS accreditation body. SV Website source phpnuke.org (c) 2003, and is Free Software under GNU / GPL licence. All Rights Are Reserved.