TS ISO/IEC 27013

TS ISO/IEC 27013 is a guidance standard for organizations that want to implement an information security management system (ISMS) based on ISO/IEC 27001 together with a service management system (SMS) based on ISO/IEC 20000-1, or integrate systems already in place. Its purpose is to clarify how the two management system frameworks fit together while keeping their different objectives distinct: one is centered on information security, the other on service management.

How ISMS and SMS connect

In general technical terms, an ISMS focuses on protecting information through confidentiality, integrity, and availability, while an SMS is concerned with the design, delivery, operation, and continual improvement of services. Because both frameworks rely on management processes such as policy setting, objectives, roles, documentation, internal audit, and management review, integration can reduce duplication and make governance more coherent. The standard’s value lies in showing how those shared elements can be aligned without treating the two systems as identical.

Implementation situations covered by the guidance

• When ISO/IEC 20000-1 is already implemented and ISO/IEC 27001 is being introduced, it supports the integration path.
• When ISO/IEC 27001 is already implemented and ISO/IEC 20000-1 is being introduced, it provides the same kind of guidance.
• When both standards are being implemented together, it helps organize a joint approach.
• When existing ISO/IEC 27001- and ISO/IEC 20000-1-based management systems are being combined, it supports harmonization.

This TSE record is withdrawn, so it represents the subject and historical scope of the document rather than an active current edition. Even so, the guidance remains useful as a conceptual bridge between security management and service management, especially where organizations need to map processes, clarify responsibilities, and align overlapping controls. In practice, the same integration logic is also commonly relevant when management systems are combined with other standards such as ISO 9001 or ISO 14001.