TS ISO/IEC 27013:2012

TS ISO/IEC 27013:2012 is a guidance standard for organizations that intend to implement ISO/IEC 27001 and ISO/IEC 20000-1 in an integrated way. It helps align information security management and service management so they can operate as coordinated parts of one management approach rather than as isolated systems.

Bringing information security and service management together

ISO/IEC 27001 is built around an information security management system (ISMS), while ISO/IEC 20000-1 addresses a service management system (SMS). Although they serve different purposes, they share common management principles such as policy setting, risk-based thinking, documentation, internal auditing, management review, and continual improvement. This standard provides general guidance on how those common elements can be handled in an integrated structure.

What integrated implementation means in practice

• It supports organizations in running two management systems in a consistent, parallel manner.
• It focuses on aligning shared processes, roles, responsibilities, and managerial controls.
• It explains, at a conceptual level, how information security requirements relate to service delivery requirements.
• It offers a planning and mapping framework for organizations choosing an integrated implementation approach.

For that reason, the document is better understood as a technical guide than as a standalone conformity specification. It is especially relevant where service performance, outsourcing relationships, and the protection of information assets need to be managed together within the same organizational framework.