ISO 20000 vs. ISO 27001 Certification- Similarities & Differences

Most entrepreneurs believe that ISO 20000 and ISO 27001 Standard are related to each other. According to them, these two standards share many things; hence implementing one standard makes the implementation of another one easier. Reality says something different.

It’s partially true that these two ISO standards have much in common; however, it will apt to admit that they complement each other. At the same time, we cannot overlook the differences they have. This blog will discuss the similarities and difference between ISO 20000 and ISO 27001 Standard.

Similarities

ISO 20000 Standard

ISO 20000 Standard concentrates on IT service management system. When an IT organization wants to demonstrate its credibility, it should gain the ISO 20000 certification to establish its credibility. It defines how to incorporate, manage, and improve IT services. However, it is not confined to what the services should do and how the services should be developed. This standard further goes on to describe how the IT services should be used and how to avoid any unpleasant incidents related to IT service management. This standard also describes how you should set up a business management system, how to deal with third parties and customer complaints. Some of these elements you can find in ISO 27001 standard; however, they have been seen from different perspectives.

ISO 20000 standard is process-based while ISO 27001 Standard is not process-based explicitly. Only a particular section (Annex A) contains a list of risk controls. For some of these controls, you may need to define a process.

ISO 27001 Standard

ISO 27001 Standard insists on the implementation and management of an Information Security Management System (ISMS). Apparently, this standard is concerned only about information. The real story is not that simple. Information is a broad term and it covers raw data, place, devices, and location where the data is kept. Information may also include devices and software for further processing and management relevant to the ISMS. Moreover, when it comes to ISO 27001 Certification, information refers to interactive channels, procurement, and supplier details, development, and legislation.

From the above discussion, it is clear that the concept of “information” becomes broader when we are talking about the ISO 27001 Standard.

Let’s have a look at some other aspects, which are common in these two ISO standards:

• Capacity

ISO 27001 needs capacity, which is required for providing an excellent system performance. ISO 20000 also has some capacity requirements.

• Configuration

Both ISO standards are looking for strong requirements related to assets. Most organizations possess assets that support IT services; such as information processing.

• Incident

ISO 20000Standar keeps information security incidents under one category. If you have incorporate incident management system while implementing ISO 20000 standard, it will be useful for ISO 27001 implementation as well.

• Modification

You need to implement a change management system to achieve ISO 20000 Certification. ISO 27001 also requires change management. ISO 20000 defines change management as a means of control of many activities including planning and designing the IT service and controlling the service.

• Supplier

Both ISO 20000 and ISO 27001 consider suppliers as one of the important elements. ISO 20000, however, requires more details to be controlled when it comes to the relationship dynamics with suppliers and sub-suppliers.

Differences

These two ISO standards have some differences as well. ISO 20000 is service-based and it considers risk as one of the building elements of IT service management system, such as financial facts, designing, and deployment of IT services, etc. while ISO 27001 is based on risk management. The former one dives deep into the regular functions of an IT organization.

A Final Takeaway

Using both standards together can be a great idea, as implementation of one standard will have a positive impact on the implementation of the other one. While implementing the first one, you should use elements, which will fit in the other standard as well. Interestingly, both standards have reusable elements. All you need is to tune the elements so that you can derive the best out of each of these two standards. It will convey a positive message to your consumers.