ISO 27001 + ISO 20000 Dual Certification: Where a Joint Build Saves

Bottom line: ISO/IEC 27001:2022 and ISO/IEC 20000-1 are two management systems with different objectives — one keeps information from going wrong, the other keeps services from stopping. Both, however, belong to the ISO management system family and share the same PDCA cycle and documented-information framework, so the "management actions" — document and record control, internal audit, management review, personnel training, supplier management — only have to be run once. What a joint build genuinely saves is duplicated management effort and duplicated audit preparation, not the professional content. On the basis of the figures we publish elsewhere on this site, combined consulting usually saves roughly 20–30% of total cost against doing the two separately; for a company that already runs ISO 9001, adding ISO 27001 through an integrated system can cut workload by roughly 30–40% — note that these two figures rest on different bases and cannot be stacked or multiplied. It should be equally clear that not every company is suited to doing both at once. If you are blocked by a single certificate in a tender, nobody internally can maintain the system over the long term, or your service processes have not yet taken shape, doing one first is the better deal.

1. First, what each standard covers

Many companies treat these two certificates as "two versions of the same thing", and that is where every later misjudgement about scheduling and budget begins. They examine two different matters.

Two scenarios make the distinction easier to see:

• Ransomware gets into the internal network, design drawings and customer data are encrypted, and the line stops for two days. This is an ISO 27001 problem — assets were never inventoried, access control was never put in place, backups were never verified, and nobody owned incident response.
• Customer repair requests are relayed through three people's WeChat, no ticket is recorded, SLA promises a 4-hour response but nobody measures it, and monthly customer satisfaction rests on impressions. This is an ISO 20000 problem — there is no service catalogue, no SLA measurement, no service desk and no incident process.

In reality these two kinds of problems often exist side by side, especially in companies that both deliver system integration/O&M and hold data on behalf of customers. That is why the "dual information" idea keeps being raised in the IT service industry: when a customer audits you, security and service are scored on two separate sheets.

2. Why they can be built together: one shared PDCA framework

The ISO standards family shares a common high-level structure. Put into documents, both sides need: management policy → objectives → roles and responsibilities → documented information → operational control → monitoring and measurement → internal audit → management review → correction and improvement. The skeleton is the same one, only the business content filled into it differs.

This has a very practical consequence: if you do them separately, you do the same thing twice —

• Document list, numbering rules, issue and withdrawal, version control: done twice;
• Record retention periods and archiving methods: decided twice;
• Internal auditor training, internal audit plan, nonconformity reports, corrective-action tracking: run twice;
• Management review inputs and outputs, meeting minutes, improvement resolutions: held twice;
• Application to the certification body, document review and on-site audit, accompanying and answering: walked through twice.

Together these actions make up a substantial share of total project effort, and they have nothing to do with the professional depth of "information security" or "IT service" — they are purely the running cost of a management system itself. This is exactly the part that can be saved.

Companies that already hold ISO 9001 have a clearer advantage: document control, internal audit and management review are already running, so for ISO 27001 you only add the information-security-specific parts (risk assessment, SoA, security controls), and workload can drop by roughly 30–40%; looked at as a system combination, integration reduces workload by roughly 30%. That is why "ISO 9001 first, then the dual information pair" is a natural route.

3. The four parts that can be merged

Merging does not mean "one set of documents with two headers". What can genuinely be merged and still hold up under audit is the following four blocks.

1. Document and record control

One document architecture, one numbering rule, one controlled document list and one record retention table covering both ISMS and ITSMS. In practice a two-layer structure works well: one layer is a management manual shared by both systems (policy, organisation, responsibilities, internal audit, management review, corrective action, document control); the other layer holds the specific professional documents (on the 27001 side, the risk assessment procedure, SoA and security control work instructions; on the 20000 side, the service catalogue, SLA management procedure and incident/problem/change/configuration management processes). An auditor checks whether "the same document is consistent across the two systems", and a two-layer structure is easier to defend as consistent than two parallel document sets.

2. Internal audit and management review

One internal audit covering both standards is entirely feasible, and it is a high-share part of the combined benefit. Two points matter:

• The audit plan needs a clause mapping. List the clauses of ISO/IEC 27001:2022 and ISO/IEC 20000-1 in one comparison table, mark "shared clauses" and "clauses specific to each", and design the checklist in two columns. One site visit then gathers evidence for both, and you do not end up "auditing security and missing service".
• Management review: one meeting, one set of minutes, two sets of inputs. The information security side inputs risk treatment progress, security incidents and the effectiveness of controls; the service side inputs SLA achievement, incident and problem trends, service improvement and customer satisfaction. The meeting can be combined, but the agenda items cannot be merged — the minutes must show review conclusions for each system separately.

3. Personnel competence and training

Awareness training, internal auditor training and the competence matrix can share one base table, branching only in the professional modules: the security side covers asset classification, access control, passwords and backup; the service side covers ticket conventions, SLA definitions and escalation paths. After merging, staff attend one consolidated training session instead of two, cutting the cost of lost production and downtime — on manufacturing sites and in resident service teams this item is often more expensive than the consulting fee.

4. Supplier and outsourcing management

Both systems require control over externally provided products and services. In practice companies often fill in two evaluation forms for the same supplier. Combine them into one supplier file with two extra columns, "information security requirements" and "service level requirements": the security side looks at confidentiality agreements, access rights and data processing arrangements; the service side looks at response times, delivery quality and breach handling. One file, two kinds of scoring, and at the annual audit you pull the file once instead of twice.

4. What cannot be merged: don't save on the professional core

Save in the wrong place and the cost is nonconformities raised in the stage 2 on-site audit, followed by rework and rescheduling. The following must be done separately.

One more point that is easily misunderstood: the certification audits themselves cannot be merged into one. Two certificates, two sets of certification rules, two technical fields; audit teams are arranged by their own field and the audit conclusions are independent. Whether the audit days can be coordinated into the same month, and whether the same audit team can take both, must be confirmed with the certification body and is subject to the body's assessment and arrangement; do not plan your internal schedule on the assumption of "one audit, two certificates".

One related note: consulting and certification are two separate roles, and industry rules require them to remain independent. Consulting helps you build the system; the certification body audits it. That boundary applies just as much to a combined project, so do not expect one party to cover everything.

5. Who should build both, and who should do one first

The test is not company size but the intersection of three things: whether the customer wants both certificates, whether your business spans both security and service, and whether anyone internally can keep two systems running day to day.

Where a joint build fits

• The business itself spans both sides. IT operations service providers, IT outsourcing providers, data centres/cloud services, government and enterprise IT suppliers, system integrators — responsible for customer data security and delivering services against SLAs.
• The customer has already asked for both. In government informatisation projects and government/enterprise IT operations tenders, information security and service capability are often scored separately, and the two certificates map to two scoring items.
• ISO 9001 or another system is already running. Document control, internal audit and management review already have a foundation, so a combined build is "adding content", not "building two systems from zero".
• There is a dedicated or stable part-time system owner. Someone who can commit continuously for 3–6 months and keep maintaining records after the certificate is issued.
• A service desk or ITSM tool is already running. ISO 20000 expects the tool to be introduced and to leave operating records; where a ticketing system is already in use, this block adds almost no extra cost.

Where doing one first is advised

• Only one certificate brings in orders. An extra certificate means an extra certification fee, an extra surveillance audit every year and an extra set of records in daily operation. The one with no customer demand behind it is a net expense.
• Service processes have not taken shape. The service catalogue cannot be written, the SLA has no historical data, repair requests are still relayed by WeChat — in that situation ISO 20000 can only be written on paper, and the operating records will not survive an audit.
• A serious security incident has just occurred, or a certificate was recently suspended or withdrawn. ISO 27001 acceptance conditions include no major cybersecurity incident within one year; ISO 20000 has a one-year requirement where a certificate was suspended or revoked (specifics are subject to the certification rules). In such a case, deal with the problem first and discuss scheduling afterwards.
• The organisation is relocating, restructuring or going live with a core system. When the record chain breaks, both systems run into trouble at once and rework costs double.
• Nobody internally can maintain it over the long term. Annual surveillance audits for two certificates, internal audits, management reviews and record archiving all need an owner. A small headcount is not the problem; the absence of an owner is.

6. Scheduling and timeline reference

Remember two hard numbers first: the typical initial certification cycle for a single system is 3–6 months, and the system must have been running for 3 months before you can apply. These two thresholds apply to both 27001 and 20000, and a joint build cannot compress them either — operating time is a fact the audit examines, not something documents can make up for.

A joint build saves time at the front and the back; the operating period in the middle cannot be saved. A reference layout follows (ranges are empirical, and actual figures are subject to the certification body's assessment):

So in terms of overall cycle: doing them separately is "3–6 months + 3–6 months", with a slack period in between when the team loses momentum; a joint build usually still falls within a 3–6 month range, simply compressing both sets of actions onto one timeline. The specifics depend on your existing management foundation, headcount and sites, how ready the tooling is and how fast the organisation responds internally.

For backward scheduling there is a simple method — count back from the month you want the certificates:

• Allow 1–2 months for the audit and for closing findings;
• Before that, running the system for a full 3 months is a hard line;
• Before that, document drafting and trial operation take 1.5–2.5 months;
• Before that, gap analysis and internal project approval take 2 weeks to 1 month.

Together that is roughly 6 months. To hold a certificate in a given quarter you have to start now, not wait for the tender notice to appear. After certification, both certificates are valid for 3 years with one surveillance audit a year — the annual audits can be aligned into the same month where the body agrees, so internally you prepare one round of records. That is the long-term dividend of building the two together.

7. Cost structure and where the saving comes from

Money for a dual build is spent in three places; only by separating them can you see where the "saving" is:

On the basis of the figures we publish elsewhere on this site, combined consulting for the two systems can save roughly 20–30% of total cost. That percentage comes from not repeating the shared parts; it does not include the certification fee charged by the certification body, which is determined by the body under its rules and has little to do with whether the build is combined.

The cost of the extra certificate also has to be counted honestly: certification fees are charged per certificate, surveillance audits are done per certificate each year, and daily record keeping runs per system. So the decision question is not "can we save 30%", but "will the second certificate bring an equivalent order or market access". If yes, build both; if not, do the one that is blocking you.

8. Common pitfalls

• One set of documents with two headers. An auditor will follow the service catalogue to the ticket records and the SoA to the risk treatment evidence. Documents can be edited; operating traces cannot be invented.
• One internal audit, but the checklist covers only one set of clauses. Without a clause mapping, gaps are certain. If you cannot say afterwards which clause maps to which standard, it shows the moment you are asked on site.
• One management review meeting, but the minutes cover only one system. Inputs and outputs must map to each standard separately, and the minutes must contain two sets of conclusions.
• Risk assessment finished and locked in a cabinet. Risk is dynamic; when assets, business or threats change, the treatment plan must be updated with them. The audit looks at when the last assessment was done and what it concluded, and whether the treatment plan is progressing.
• An ITSM tool is in place, but work is still dispatched by WeChat. A ticketing system bought and not used, used but not recorded, recorded but not measured is the same as having none. ISO 20000 looks at the real data inside the tool.
• Treating "3 months of operation" as negotiable. What gets compressed in backward scheduling is often exactly those three months, and the result is a returned application or insufficient records at audit.
• Using the same firm for consulting and certification. Industry rules require the two to be independent; do not test that boundary.
• Stopping once the certificate arrives. Both certificates have a surveillance audit every year; if records are not accumulated daily and material is rushed together before the audit, the pain repeats every year.

Action checklist: three steps to decide whether to build both

For the checklist below, have the system owner sit down once with business, IT and sales and tick each line:

• ☐ Check where the demand comes from. Pull out the tender documents, customer factory-audit forms and contract clauses you already know about for the next 12 months, and see whether they require ISO 27001, ISO 20000, or both.
• ☐ Inventory what you already have. Is ISO 9001 or another system already running? Are document control, internal audit and management review actually running (not just documented)?
• ☐ Inventory the service side. Is there a service catalogue and an SLA? Is there a service desk or ticketing system? How long has it run, and are there measurable records?
• ☐ Inventory the security side. Is there an asset inventory? Has a risk assessment been done? Has there been a major cybersecurity incident in the past year?
• ☐ Name the owner. Who will be the system owner? How many hours a week can they commit? Who maintains it after certification?
• ☐ Ask the body. Confirm with a certification body the accepted scope, how headcount and sites are counted, and whether audit timing can be coordinated, then fix the schedule.

If "where the demand comes from" and "inventory the service side" cannot be ticked, that usually means now is not the time to do both at once; if both are clear and only internal staffing is tight, you can proceed, but allow 1–2 extra months in the schedule.

In the end, a dual build is not about "buying two certificates together because it is cheaper" — it is about organising the management actions your company has to perform anyway into one language an auditor recognises. Documents combined, internal audit combined, management review combined, professional content kept where it belongs — a system built this way does not have to be reopened from scratch at every annual audit.

▍Want to know whether your company should do one or both? Send us your headcount, main business, customer requirements and target certification date, and we will produce a one-versus-both comparison path and timetable.

CertFastLine | Export Certification & Testing & Management Systems Consulting This article is a compliance reference for general information, not legal advice; cycles, headcount and costs are ranges only, and specifics are subject to the certification body's assessment

Related reading: ISO 27001 information security management system · ISO 20000 IT service management system · how to prepare for ITSS certification · choosing among the eight CCRC categories · all management system certifications · contact us