ISO/IEC 27013:2012 — Information technology — Security techniques — Guidance on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1

This standard provides guidance on implementing an integrated information security and IT service management system, based on both ISO/IEC 27001:2005 (ISMS) and ISO/IEC 20000-1:2011 (IT service management specification, derived from ITIL) - two management systems that complement and support each other’s aims.

27013 advises users on the processes and supporting documentation required to implement an integrated dual management system, for example helping them to:

Implement ISO/IEC 27001 when they have already adopted ISO/IEC 20000-1, or vice versa;
Implement both ISO/IEC 27001 and ISO/IEC 20000-1 together from scratch (brave souls!); or
Align and coordinate pre-existing ISO/IEC 27001 and ISO/IEC 20000-1 management systems.

The standard proposes a framework for organizing and prioritizing activities, offering advice on:

Aligning the information security and service management and improvement objectives;
Coordinating multidisciplinary activities, leading to a more integrated and aligned approach (e.g. both donor standards specify incident management activities, with differing scopes for the incidents but otherwise quite similar);
A collective system of processes and supporting documents (policies, procedures etc.);
A common vocabulary and shared vision;
Combined business benefits to customers and service providers plus additional benefits arising from the integration of both management systems; and
Combined auditing of both management systems at the same time, with the consequent reduction in audit costs (we hope!).

The scope of this standard spans two ISO/IEC JTC1 subcommittees. SC27 and SC7 collaborated to ensure that the information security and service management perspectives were both duly considered.

Two annexes compare the 27001 and 20000 standards side-by-side.

Note: while the approach recommended by ISO/IEC 20000 was derived from ITIL (the IT Infrastructure Library, owned by the British OGC - Office of Government Commerce), there are subtle differences in the details. Differences between the latest version of ITIL, ITIL v3, and ISO 20000-1 are explained here. ISO/IEC 27013 reflects the 2011 version of ISO 20000-1.

Status of the standard

While additional, pragmatic advice would help organizations implement both ISO27k and ISO20k, the standard has been released as-is rather than wait another year for further inputs at this stage.

The standard was published in October 2012.