Toolkit Library / Integrated Management System Toolkit: ISO 9001 + ISO/IEC 27001 (Quality and Information Security)

Bundle

Integrated Management System Toolkit: ISO 9001 + ISO/IEC 27001 (Quality and Information Security)

ISO 9001 + ISO/IEC 27001

One set of original DSQA documents for running quality and information security as a single management system.

Original documents written for the current editions
Independent, not affiliated with ISO
Fixed fee

Who it's for

Organisations that already hold, or are working towards, ISO 9001 and now need ISO/IEC 27001, often because customers or tenders ask for it
IT, software, managed service, data and professional services businesses where service quality and information security go hand in hand
Small and medium-sized teams that want one set of policies, registers and meetings rather than two parallel systems
Quality, compliance or operations managers who look after both areas

Why integrate

Running both standards as one system means one set of core processes, one audit programme and one management review, with the extra requirements of each standard added where they differ.

Shared structure: both standards follow the same harmonised structure (formerly Annex SL), with the same clause headings from 4 to 10, so one document can serve both where the requirements overlap
One context, scope and interested parties analysis covering customers, quality and information security
A single approach to risks and opportunities, with the information security risk assessment and treatment sitting alongside business and quality risks
Combined internal audit programme: one schedule and one audit report format, auditing quality and information security together or in rotation
One management review that covers quality performance, customer feedback, security incidents and risk treatment in a single meeting
Shared document control, competence and training, awareness, communication, nonconformity and corrective action and improvement processes
Less duplication and paperwork, clearer responsibilities, and a combined audit when your certification body offers one

Documents included

This is the planned list of 31 original DSQA documents, grouped by the clause they support. The final list may change before the toolkit goes on sale.

4 Context of the organization

Integrated context and interested parties register
Integrated management system scope statement (quality and ISMS scope)
Process map and process interaction guide
Integrated management system manual

5 Leadership

Integrated quality and information security policy
Roles, responsibilities and authorities matrix

6 Planning

Integrated risks and opportunities register
Information security risk assessment and treatment methodology
Information security risk register and risk treatment plan
Statement of Applicability template
Integrated objectives plan
Change planning form

7 Support

Resources and infrastructure plan
Competence and training matrix
Induction checklist
Quality and security awareness briefing pack
Communication plan
Document and record control procedure and master document list
Monitoring and measuring equipment log

8 Operation

Operational planning and control procedure
Customer requirements review form
External provider and supplier evaluation procedure, approved supplier list and supplier security questionnaire
Production and service provision control procedure
Nonconforming output procedure and log
Topic-specific information security policy set covering organisational, people, physical and technological controls

9 Performance evaluation

Integrated monitoring and measurement plan
Customer satisfaction survey template
Integrated internal audit procedure, programme and report template
Integrated management review agenda and minutes template

10 Improvement

Complaints, incident, nonconformity and corrective action procedure and log
Continual improvement log

Free samples

Samples coming soon We'll publish free sample documents from this toolkit here, so you can see the style and depth before you buy.

What's not included

This toolkit contains original DSQA documents only. It doesn't include the text of ISO 9001 or ISO/IEC 27001.

Certification isn't included either. If you want a certificate, an independent certification body carries out the audit. Our documents help you prepare for certification.