ISO 27001 and ISO 9001: what you can reuse, what is new, and how to run one integrated system

ISO 9001 and ISO 27001 share the Harmonized Structure, clauses 4 to 10, so a certified quality system already runs most of the machinery ISO 27001 needs: document control, internal audit, management review, corrective action. What is new: information security risk assessment and treatment, the Statement of Applicability and 93 Annex A controls. Integrated audits save at most 20% of audit time.

This guide covers the shared structure, what you can reuse, what is new, the risk trap, integrated audits and audit time, ISO 9001:2026, the technical reality, and a checklist.

Clause	ISO 9001 already gives you	ISO 27001 adds	Reuse
4 Context	Issues, interested parties, scope	A security view of the same analysis	Mostly
5 Leadership	Commitment, policy, roles	Security policy and roles	Mostly
6 Planning	Risks and opportunities, objectives	Risk assessment (6.1.2), treatment and SoA (6.1.3)	Little
7 Support	Competence, awareness, document control	A security awareness strand	Mostly
8 Operation	Producing products and services	Running risk assessment (8.2) and treatment (8.3)	Little
9 Performance evaluation	Monitoring, internal audit, management review	Security measures, new audit scope	Mostly
10 Improvement	Nonconformity and corrective action	Nothing new	Fully
Annex A	No equivalent	93 controls, each considered	None

How do ISO 9001 and ISO 27001 fit together?

Both follow the Harmonized Structure, the template ISO requires for management system standards that set requirements. It sits in Annex SL of the ISO/IEC Directives, Part 1, and fixes identical clause numbers, titles, core text and core definitions. It was introduced in 2012 as the high level structure and revised in 2021.

This is not a marketing similarity. The core text of clauses 4 to 10 is close to identical, differing mainly in whether the subject is quality or information security. If you satisfy it for one, the machinery satisfies it for the other. Each standard adds its own requirements. ISO 9001’s clause 8 is about producing products and services; ISO 27001’s is about running risk assessment and treatment.

ISO/IEC 27001:2022 already follows the 2021 structure. ISO 9001:2015 was written on the 2012 version, and ISO 9001:2026 adopts the latest one, so the two now line up more closely.

What can you reuse from ISO 9001 for ISO 27001?

In our assessments, these come across almost intact:

• Document and record control (7.5). Your versioning, approval and retention system works unchanged. Security policies slot into it.
• The internal audit programme (9.2). Same programme, new scope, same auditors if they are competent in information security. See internal audit and management review.
• Management review (9.3). The inputs differ in content, not structure. One meeting can review both systems if the agenda covers both input lists.
• Nonconformity and corrective action (10.2). The same process. You already run it.
• Competence and awareness (7.2, 7.3). Induction, training records and a competence matrix exist. Security awareness becomes another strand.
• Leadership and policy (clause 5). Top management commitment and an approval route exist.
• Context and interested parties (4.1, 4.2). The analysis exists and needs a security lens. Both standards were amended in 2024 to ask whether climate change is a relevant issue; one answer serves both.
• The certification body relationship. You know how an audit runs, how nonconformities are graded and how to prepare. That is worth more than it sounds.

This starting position is routinely undersold by people quoting for the work. You have already proved you can run an audited system, the part many companies find hardest.

What does ISO 27001 add that ISO 9001 does not have?

Clause 6.1.1, the general duty to address risks and opportunities, is shared text. Below it, ISO 27001 adds three things. They are the whole job.

Information security risk assessment (6.1.2)

A defined process that sets risk criteria, including acceptance criteria, and gives consistent, valid and comparable results when repeated. It identifies risks to the confidentiality, integrity and availability of information in scope, names an owner for each, assesses consequences and realistic likelihood, and ranks the results against your criteria. Clause 8.2 repeats it at planned intervals and on significant change. No asset, threat and vulnerability method is required; that is one approach among several. What the record must carry is in the risk register that survives an audit.

Risk treatment and Annex A (6.1.3)

You choose treatment options, determine the controls needed, and compare them with the 93 Annex A controls so that no necessary control is missed. Risk owners approve the treatment plan and accept the residual risk, and clause 8.3 requires you to implement it. Nothing in a quality system prepares you for this. It takes months, because many controls describe technical capability you may not have yet.

The Statement of Applicability

One document listing the necessary controls, why each is included, whether it is implemented, and why any Annex A control is excluded. ISO 9001 has no equivalent. In practice it is usually the first document an ISO 27001 auditor opens, and it shapes the rest of the audit. See scope and Statement of Applicability.

Does your ISO 9001 risk process cover ISO 27001?

No. In our experience this is the single most expensive assumption, and it usually surfaces at Stage 1.

A quality manager reasonably concludes that the process satisfying ISO 9001 clause 6.1 meets ISO 27001 by extension. It does not. ISO 9001:2015 states in Annex A.4 that “there is no requirement for formal methods for risk management or a documented risk management process”. ISO 27001 prescribes the elements: criteria, a repeatable process, risk owners, a treatment plan, documented acceptance of residual risk. A quality risk table will not be accepted as one.

In practice, finding this at Stage 1 costs about a month. At Stage 2 it can be a major nonconformity. Treat the information security risk work as a separate build from day one and the problem disappears.

Can ISO 9001 and ISO 27001 be audited together?

Yes, without two parallel processes. IAF MD 11, the accreditation rule for integrated management system audits, covers audits against two or more standards at once and names ISO/IEC 27001 among its examples. Reports can be integrated or separate, but every finding must be traceable to its standard.

In practice, two conditions matter:

1. The body must be accredited for ISO/IEC 27001, not only ISO 9001. Accreditation is per scheme. Check the accreditation body’s register.
2. The auditors need competence in both standards. Otherwise the team grows and the saving shrinks.

Staying with your ISO 9001 body is usually worth it if it holds the ISMS accreditation. A sensible sequence: certify ISO 27001 alongside a 9001 surveillance visit, then align both cycles at the next recertification.

How much audit time does an integrated audit save?

Less than people hope. Under IAF MD 11 the body calculates each standard’s audit time separately, IAF MD 5 for ISO 9001 and ISO/IEC 27006-1 for ISO 27001, and adds them to get a starting point. It adjusts for how integrated your system is, how well your people handle both standards, and the audit team’s competence across them. A reduction may not exceed 20% of the starting point, and the rule notes that an integrated audit could also result in more time.

An illustration for 40 people in scope, both at initial certification:

Standard	Audit days
ISO 9001 (IAF MD 5, 26 to 45 people)	4
ISO 27001 (ISO/IEC 27006-1, 26 to 45 people)	8.5
Starting point	12.5
Integrated, maximum 20% reduction	no fewer than 10

Both figures come before other adjustments. Even without the cap, the saving could not approach half, because only clauses 4 to 10 combine. The risk assessment, the Statement of Applicability and Annex A, the bulk of an ISO 27001 audit, do not. Get the day count in writing; the rest of the budget is in ISO 27001 certification cost.

What does the certification body mean by “integrated”?

IAF MD 11 judges integration on seven characteristics. The right-hand column is a practical reading, not the rule’s text:

ISO 9001 + ISO 27001 INTEGRATION SELF-CHECK
(characteristics from IAF MD 11, Annex 1)

Characteristic            Integrated in practice when              Y/N
------------------------  ---------------------------------------  ---
Documentation             One document set, one control process,
                          work instructions cover both
Management review         One review covers both input lists and
                          the overall business strategy
Internal audit            One programme, auditors competent in
                          both standards
Policy and objectives     Set, approved and tracked in one process
System processes          Shared processes, e.g. suppliers,
                          change, competence
Improvement mechanisms    One corrective action process and log
Management support        One set of roles, one top management
and responsibilities      accountable for both

What does ISO 9001:2026 change for an integrated system?

ISO published ISO 9001:2026 on 16 September 2026. It adopts the latest Harmonized Structure, puts more weight on leadership, quality culture and ethical behaviour, and separates managing risks from pursuing opportunities more clearly. Global ACI, which replaced the IAF on 1 January 2026, set a three-year transition: ISO 9001:2015 certificates must move by 30 September 2029, and from 31 March 2028 new accredited certifications are issued only to the 2026 edition.

The timing helps. You will rework the quality risk and opportunity process anyway. A sensible approach is to do it while you build the ISO 27001 risk method, keep the two separate, and ask the body to plan both audits into the same visits.

Why do customers ask ISO 9001 holders for ISO 27001?

A wall of ISO certificates with no ISO 27001 tells a customer’s security reviewer two things. You can sustain an audited system, which puts you ahead of many suppliers. And information security is the one discipline you have not submitted to external examination, precisely the wrong gap when the tender is about security. So the request comes from procurement, with a date attached. Check it against how long ISO 27001 really takes.

The technical reality: a quality system proves process, not defence

Your quality certificate proves you can define a process, follow it, audit it and correct it when it drifts. That competence is real and it transfers. It does not tell you whether an administrator account belonging to someone who left in March still works, whether an internet-facing service is behind on patches, whether your backups have ever been restored, or whether a supplier still has network access under a contract that ended last year.

ISO 27001 will ask you to declare that these things are managed. It will not, on its own, tell you whether they are true this week. These controls live in the identity provider, the endpoint tools and the cloud accounts, and drift between audits. That is the gap between an audited system and a defensible one.

Closing it means collecting that evidence from the systems continuously, with a person reviewing the exceptions. That is how the CloudSoul platform works, as an automated platform with human-in-the-loop expertise. A security audit measures the gap against what you already have certified, and the full route is on the ISO 27001 page.

ISO 27001 and ISO 9001 integration checklist

• Map your quality procedures to ISO 27001 clauses 4 to 10 and mark what transfers.
• Build the information security risk method separately: criteria, acceptance level, owners.
• Run risk treatment against Annex A and write the Statement of Applicability.
• Extend the audit programme and review agenda to cover both standards.
• Confirm the body is accredited for ISO/IEC 27001; get the integrated day count in writing.
• Plan the ISO 9001:2026 transition, due by 30 September 2029, with the ISO 27001 audit.
• Test technical controls in the systems, not only the documents, before Stage 2.

Sources

• ISO/IEC 27001:2022, clauses 4 to 10, 6.1.2, 6.1.3, 8.2, 8.3 and Annex A, ISO.
• ISO/IEC 27001:2022/Amd 1:2024, Climate action changes, ISO.
• ISO 9001:2015, clause 6.1 and Annex A.4, and ISO 9001:2015/Amd 1:2024, ISO.
• ISO 9001:2026, published 16 September 2026, ISO, and ISO news release, ISO.
• ISO/IEC Directives, Part 1, Consolidated ISO Supplement, Annex SL, Appendix 2 (Harmonized structure for MSS), ISO, and ISO management system standards, ISO.
• IAF MD 11:2023, Application of ISO/IEC 17021-1 for audits of integrated management systems, clauses 2.1 and 2.4 and Annex 1, IAF.
• IAF MD 5:2023, audit time for quality, environmental and OH&S management systems, Table QMS 1, IAF.
• ISO/IEC 27006-1:2024, requirements for bodies certifying information security management systems, ISO.
• Global ACI, transition requirements for ISO 9001:2026, 16 September 2026, Global ACI, and launch on 1 January 2026, Global ACI.

Frequently asked questions