Can a quality management system (QMS) that is already in place serve as the foundation for an information security management system (ISMS)? Yes, it can. The two standards have a lot in common.
ISO 9001 describes how a quality management system should be structured, and ISO/IEC 27001 does the same for an information security management system. As far as the management system is concerned, they are equivalent. What does that mean?
The same foundation: the PDCA cycle
Management systems are built on the Plan, Do, Check, Act cycle (PDCA), which W. Edwards Deming popularized in the mid-twentieth century based on the work of Walter Shewhart. The cycle works like this:
- Plan: define what you want to achieve with the management system.
- Do: implement what was planned.
- Check: monitor whether the planned objectives were achieved.
- Act: take action to close the gap between what was planned and what was achieved, or to improve the results obtained.
The model was originally designed for quality management, but it was adopted as the basis for many other management systems: for example, environmental management (ISO 14001) and information security (ISO/IEC 27001).
On top of that, ISO management system standards share a high-level structure, defined in Annex SL of the ISO/IEC Directives and now called the harmonized structure. ISO 9001:2015 and ISO/IEC 27001:2022 have the same clauses, in the same order, and many identical texts and definitions:
- 4, Context of the organization.
- 5, Leadership.
- 6, Planning.
- 7, Support.
- 8, Operation.
- 9, Performance evaluation.
- 10, Improvement.
That is why several elements you implemented in your ISO 9001 quality management system can also be applied to the information security management system. Let’s look at some examples.
What you can reuse from the QMS
Context analysis
Both standards require you to determine external and internal issues (clause 4.1), relevant interested parties and their requirements (4.2) and the scope of the system (4.3). The context analysis you did for ISO 9001 is a solid foundation, but ISO/IEC 27001 asks you to look more closely at some aspects specific to information security:
- Identifying information assets
- ISO 9001: does not necessarily focus on information assets.
- ISO/IEC 27001: requires you to identify and classify information and associated assets, such as data, IT systems and hardware. In the 2022 version, the inventory and the classification are Annex A controls (5.9 and 5.12).
- Risk assessment
- ISO 9001: focuses on the risks and opportunities that affect the conformity of products and services and the ability to meet customer requirements (clause 6.1).
- ISO/IEC 27001: requires a formal process to identify, assess and treat information security risks, that is, the loss of confidentiality, integrity and availability (clauses 6.1.2 and 6.1.3).
- Legal and regulatory requirements
- ISO 9001: includes compliance with the legal and regulatory requirements that apply to products and services.
- ISO/IEC 27001: places additional emphasis on information security and personal data protection laws and regulations. In Argentina, for example, Law 25,326.
- Controls
- ISO 9001: focuses on controlling processes, products and services.
- ISO/IEC 27001: requires you to implement information security controls based on Annex A of the standard and to justify, in the statement of applicability, which ones apply and which do not.
Document management
The procedure you use to manage documented information in the QMS (clause 7.5 in both standards) can be applied to the ISMS, with adjustments that depend on each case.
Internal audit
The same procedure works for the QMS and the ISMS (clause 9.2), although the internal audits of each system may be carried out by different people, because each one requires knowledge of its own discipline.
Corrective action
The QMS procedure for handling nonconformities and corrective actions (clause 10.2) can be used for the ISMS. Since both standards adopted the high-level structure, there is no longer a separate requirement for preventive action: that role is played by addressing risks and opportunities under clause 6.1.
Human resources management
The cycle of planning, training and evaluating staff (competence and awareness, clauses 7.2 and 7.3) applies to both management systems. The difference is that, for ISO/IEC 27001, the competence and knowledge profile has to cover specific information security aspects.
Management review
The principles of management review (clause 9.3) are similar in both systems. Management, used to making decisions in the context of the QMS, can apply the same principles to the ISMS.
Management system objectives and monitoring
Both systems use a similar mechanism to set objectives and monitor them (clause 6.2), so management will already be used to this kind of strategic planning.
The answer to the initial question
If an organization has already implemented ISO 9001, implementing ISO/IEC 27001 will be easier for it, and the project may even be shorter. Certification also becomes more accessible: certification bodies can offer integrated ISO 9001 and ISO/IEC 27001 audits, with lower fees than if the standards were audited separately.
If your QMS works well, the project to implement and integrate an ISMS will move forward smoothly: management will better understand the possible business benefits, and every area of the organization will already be used to defining precise procedures, responsibilities and documentation.
In short, a QMS is an excellent foundation for information security. If your organization already has ISO 9001 certification and you want to protect the information you work with, seriously consider implementing ISO/IEC 27001.
One difference: more policies than procedures
Now, one difference. An ISMS under ISO/IEC 27001 tends to rely more on policies, while a QMS under ISO 9001 is characterized more by its procedures. There are several underlying reasons for that difference.
Why ISO/IEC 27001 has more policies
- The nature of information security. Protecting information means safeguarding its confidentiality, integrity and availability, especially for sensitive data. That requires clear policies that define what is protected, how it is protected and who is responsible for protecting it. Policies provide strategic direction and a frame of reference for all information security activities.
- The need for governance. Information security needs strong governance, so that every interested party understands its roles and responsibilities. Policies help establish it, because they define the behavior and compliance expected across the organization.
- Legal and regulatory compliance. Organizations have to comply with numerous data protection and privacy laws and regulations. Policies are needed to ensure that compliance and to demonstrate it to interested parties and external auditors.
- Risk management. Information security is based on identifying, assessing and treating risks. Policies set the organization’s approach to those risks and ensure that the measures taken are consistent and appropriate.
- Security culture. Policies help build a security culture. When expectations and guidelines are clearly communicated, everyone in the organization understands why information security matters and acts accordingly.
ISO 9001: procedures for processes
ISO 9001 focuses on the quality of the products and services the organization provides. Procedures are key to standardizing operations, ensuring consistency in production and service, and enabling continual improvement. They document good practices and ensure that activities are always carried out the same way. Above all, they focus on describing how the organization’s processes are carried out to achieve customer satisfaction.
ISO/IEC 27001: policies as a framework
ISO/IEC 27001, on the other hand, focuses on protecting information. Here, policies are critical to establish the framework and guidelines for managing security and risks. Procedures are used too, but policies are the basis for strategic decisions and for ensuring that security good practices and regulations are followed. Above all, they focus on describing what actions and criteria are taken into account to protect information within the organization’s processes. The standard requires an information security policy (clause 5.2) and, in Annex A, topic-specific policies (control 5.1).
Policies and procedures, in both systems
None of this means that a quality management system does not need policies (in fact, the quality policy is mandatory in ISO 9001:2015) or that an information security management system does not need procedures: they are needed to describe how the organization carries out certain processes to comply with its policies.
In short, the greater weight of policies when implementing ISO/IEC 27001:2022 reflects the need for a clear strategic framework and the governance required to protect information. In any management system, policies set the general guidelines and expected behavior, and operating procedures ensure that those policies are applied effectively.