A Comparison of ISO 9001 and ISO 27001

Sue West
|
Senior Quality Management Consultant at URM
|
PUBLISHED on
14 Feb
2024

Since 1947, the International Organisation for Standardisation (ISO) has developed international standards to support organisations across all industry sectors at a global level.  It was only in 2012, however, that ISO developed the ‘Annex SL Structure’.  This structure provides consistency and compatibility between various management system standards, such as ISO 9001 and ISO 27001.

Background

ISO 9001 and ISO 27001.

The introduction of the Annex SL Structure now makes it easier for organisations to understand and integrate multiple management system standards, as all the content is now categorised under the 10 clauses of the Annex SL Structure, with Clauses 4 – 10 being the ones that are audited by certification bodies.

The Structure applies ‘Plan-Do-Check-Act’ - an iterative design and management methodology to control and continually improve processes, products, and services.

Plan-Do-Check-Act’

There are a multitude of management system standards that organisations can implement and potentially certify to, but here we are focusing on two of the most popular standards, ISO 9001, and ISO 27001.  One of the main purposes of this blog is to highlight possible opportunities to merge various processes and policies that form part of the two management systems when implementing both standards.

Core Purpose

ISO 9001 is a quality management system (QMS). It was first issued in 1987 and today is one of the most well-used management tools.  It provides a framework that enables organisations to:

  • Ensure consistent quality in the provision of products and services that meet customer and regulatory/statutory requirements
  • Identify and address areas for improvement
  • Enhance customer satisfaction.

It encompasses the daily operational activities required to produce and deliver products and services and can be implemented by any organisation, regardless of size or business sector.

ISO 27001 is a management system standard for Information Security Management Systems (ISMS) that can also be applied to any organisation, regardless of size or type.  It was first published in 2005 and is an effective and pragmatic tool for minimising information security risks. It promotes the effective management of:

Where an organisation has implemented a management system based on either ISO 9001 or ISO 27001, it is possible to expand the existing system to incorporate the other Standard.

In summary:

  • A QMS is a compilation of business processes and procedures that work together to provide products and services that meet customer expectations.
  • An ISMS is a systematic approach to managing the privacy and security of information controlled by an organisation during the conduct of its business activities.

Comparison

Whilst similar, the requirements of each Standard differ in terms of their context, i.e., ISO 27001 requirements are specific to information security management and ISO 9001 requirements are specific to quality management.  These contextual differences are not addressed here.

Clause 4: Context of the Organisation

Both Standards require organisations to determine relevant internal and external issues that affect their management system (MS), as well as interested parties and their requirements – including relevant legal (statutory and regulatory) requirements.

ISO 27001, however, allows organisations to select which relevant requirements of interested parties will be addressed by the ISMS (Clause 4.2c), whereas ISO 9001 does not.

In both Standards, there is a requirement to define and document the boundaries and applicability (scope) of the management system.

A key difference when determining scope is that ISO 27001 requires the organisation to consider the dependencies and interfaces with activities performed by other organisations.  This is not a requirement of ISO 9001, although it does include control of externally-provided processes, products, and services in Clause 8.4.

It should be noted that while ISO 27001 explicitly forbids an organisation from excluding requirements of the Standard from the scope of its MS, ISO 9001 does allow exclusions if documented and justified.  These exclusions must not adversely impact the conformance of the product or service, or customer satisfaction.

Many organisations exclude Clause 8.3 (design and development of products and services) from their QMS. However, if an organisation introduces or changes its service provision, this can require design and development activities.

Clause 5: Leadership

Both Standards require organisational leadership (top management) to take accountability for the effectiveness of the MS.  ISO 9001, however, stipulates an additional element of leadership, i.e., it requires a customer-focused approach.

Both Standards have similar criteria for a policy, which can be addressed in one document, although ISO 27001 also requires additional ‘topic specific’ policies in its Annex A.

Roles, responsibilities, and authorities required by ISO 27001 focus on information security, while ISO 9001 refers to all business processes within the scope of the QMS.

Annex A of ISO 27001 includes a requirement to ensure segregation of duties where appropriate. While this is specific to an ISMS, it is good business practice for any management system to ensure there is no conflict created when allocating responsibilities and authorities.

Clause 6: Planning

Both Standards require the identification of risks and opportunities within the context of that particular Standard.  However, it’s important to note that ISO 27001 is far more stringent in the assessment of these risks, and the subsequent application of risk treatment options/plans.  

A fairly obvious and fundamental difference between the two standards is that unlike ISO 9001,  ISO 27001 includes an annex, i.e., Annex A - Information security controls reference. The Annex details a list of control measures to be implemented to manage risks identified during the risk analysis process and associated with the ISMS.  These controls are aligned to themes, Clauses 5-8.

This clause includes a requirement to establish objectives, and plan to achieve them. It is important to consider and plan how objectives are to be achieved.

Clause 7: Support

For both Standards, an organisation needs to determine and provide resources necessary to establish, implement, maintain, and continually improve their MS.  ISO 9001, however, has more extensive requirements relating to the business infrastructure, environment and knowledge that support the processes.

Competency requirements apply to all personnel, including management. It is not unusual for organisations to overlook competency requirements for those activities that are not day to day, e.g. internal auditors need to be competent in auditing and be knowledgeable about the relevant Standard.

Clause 8: Operations

Although both Standards require operational planning and control, it is here where major differences between ISO 9001 and ISO 27001 occur.

ISO 27001 has two subclauses which focus on the application of the risk assessment methodology, previously established in Clause 6, and the subsequent use of the control measures which have been identified from Annex A.  The two sub-clauses are:  

ISO 9001 on the other hand has seven subclauses which focus on defining and controlling the processes for the provision of products and services, including:

  • Operational planning and control
  • Requirements for products and services
  • Design and development of products and services
  • Control of externally provided processes, products, and services
  • Production and service provision
  • Release of products and services
  • Control of nonconforming outputs.

While organisations are generally well versed in these operations, there is a tendency to overlook the need to control and manage changes at the operational level, so careful consideration should be given to this when developing and implementing an ISMS or QMS.

Clause 9: Performance Evaluation

Both Standards require ongoing monitoring, measurement, analysis, and evaluation of the MS, although again, because of the focus of the Standard, ISO 27001 does not include customer satisfaction.

The processes for audits and management review are very similar, with variations again relating to the subject matter focus of the Standards, e.g., ISO 9001 requires changes to the organisation to be considered when developing the audit programme.

Organisations generate a mountain of data, and careful consideration needs to be given to what needs to be monitored and measured, and why.  The allocation of personnel to these activities needs to ensure appropriate independence and objectivity.

Clause 10: Improvement

Information security and quality management systems can use the same processes, as both Standards require continual improvement of the suitability, adequacy, and effectiveness of the MS.  The objective of this clause is to effectively identify and action opportunities for improvement as well as manage nonconformities and implement appropriate correction and corrective action.

It is not uncommon for organisations to confuse ‘correction’ and ‘corrective action’ which can result in unnecessary activities. It is beneficial to ensure these are clearly defined and implemented as appropriate.

How URM Can Help

URM has helped over 400 organisations conform and/or certify to ISO 27001 and other management system standards such as ISO 9001 and ISO 22301, without a single failed certification project.  Our large team of ISO 27001 consultants and other ISO management system specialists can assist you in merging the various management systems into an integrated business management system.  This will also allow you to streamline the processes involved in various conformance activities, such as your ISO 9001 and ISO 27001 audits.

Sue West
Senior Quality Management Consultant at URM
Sue is an experienced quality management practitioner, with more than 25 years of extensive involvement in the establishment, management, and auditing of quality management systems, as well as quality and auditor training. She has been involved with the development or integration of management systems against various standards, such as ISO 9001, ISO 27001, ISO 20000, FSC, TL9000 and ISO 17021 (for certification bodies).
Read more

Book FREE Consultation

URM is pleased to provide a FREE consultation on Transitioning to ISO 27001:2022 for any UK-based organisation.
Thumbnail of the Blog Illustration
Information Security
Published on
20/7/2022
Information Security Management Systems, ISO 27001 and the Benefits of Implementation

In this blog, we’re going back to basics and looking at some of the fundamentals of information security and ISO 27001.

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
28/10/2022
ISO/IEC 27001:2022 Key Changes

Following the publication of ISO/IEC 27001:2022 on 25 October 2022, this blog will provide you with our high-level analysis of the key changes.

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
27/7/2022
How Do You Go About Your ISO 27001 Information Classification?

This blog talks about information classification. So, what exactly do we mean by information classification?

Read more
Thank you that was great! We've already started work on review the controls - hadn't picked up on the change to risk management approach that this will drive so thank you for highlighting that!
Webinar 'ISO 27001:2022 – What’s new?'
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.