How do we add ISO 27701, ISO 22301 or ISO 9001 to our ISMS without doing the same work twice?

Start

We run an ISMS and want to add another management system standard

ISO 27001 shares its management system clauses with ISO 22301 (business continuity) and ISO 9001 (quality), and the 2025 edition of ISO 27701 (privacy) has its own management system clauses too. The shared clauses cover context, leadership, planning, support, operation, performance evaluation and improvement. That is why one system can serve several standards. Each standard also adds its own requirements, and those are the extra work.

• Then: State who needs the second certificate and for what scope

Step

State who needs the second certificate and for what scope

Write down the customer, regulator, contract or internal reason, the services it covers and the date it matters. A second standard has a continuing cost in audits, records and attention. If nobody needs the certificate, the practice may be enough without it.

• Then: Does someone require the certificate, rather than just want it?

Decision

Does someone require the certificate, rather than just want it?

A customer clause, a tender, a regulator's expectation or a contract is a reason. A general wish to look mature is not. Not known: ask the person who raised it what would happen without it.

• Yes, or not known: Is the ISMS running, with an internal audit and a review held?
• No: No requirement yet: use the practice and revisit when one appears

Outcome

No requirement yet: use the practice and revisit when one appears

You can adopt useful parts, such as a business impact analysis, without a second certificate. Record the decision and the trigger that would reopen it. Do not claim conformity to the other standard without certification or an assessment that supports the wording.

Decision

Is the ISMS running, with an internal audit and a review held?

Integration builds on a working system. If the ISMS has not yet run an internal audit and a management review, a second standard doubles the unfinished work. The ISMS comes first.

• Yes: Map the shared requirements to the work you already do
• No, or not known: Finish the ISMS first; add the second standard once it is running

Outcome

Finish the ISMS first; add the second standard once it is running

Complete the first certification cycle or at least a full internal audit and management review. Then come back. Planning the second standard early is fine. Certifying both at once on an untried system is a risk.

Step

Map the shared requirements to the work you already do

List the requirements both standards share: context and interested parties, policy, objectives, risks and opportunities, resources, competence, awareness, documented information, internal audit, management review and corrective action. For each, point to the ISMS routine that already does it. Do not write a second copy.

• Then: Is the new standard's scope the same as the ISMS scope?

Decision

Is the new standard's scope the same as the ISMS scope?

The same services, sites and people make integration straightforward. A different scope means a second scope statement and records for the extra part. A scope that overlaps only partly is the usual source of duplicate work.

• Yes: Reuse one set of routines for the shared clauses
• No, or not known: Define the new scope and decide whether to align the two

Step

Define the new scope and decide whether to align the two

Write the new scope statement. If a small change to the ISMS scope would make them match, consider it with top management. If they must differ, keep the shared routines and say clearly where the boundaries lie.

• Then: Reuse one set of routines for the shared clauses

Step

Reuse one set of routines for the shared clauses

Use one document control, one internal audit programme, one management review with added agenda items, and one corrective action log. The pack's advice for an organisation already certified to another standard is the same. Keep one risk process that can hold the extra kinds of risk.

• Then: Which standard are you adding?

Decision

Which standard are you adding?

The shared clauses are the same work. What differs is what each standard adds, so look at them one at a time.

• ISO 27701: Privacy (ISO 27701): add privacy risk, roles and the privacy controls
• ISO 22301: Continuity (ISO 22301): add impact analysis, plans and exercises
• ISO 9001: Quality (ISO 9001): add customer requirements and quality objectives

Step

Privacy (ISO 27701): add privacy risk, roles and the privacy controls

Add the processing of personal data to the scope, the roles you hold as controller or processor, privacy risk and the privacy controls. Sources describe the 2025 edition as certifiable without ISO 27001, while the 2019 edition was an extension of it. Confirm with your body. Your data protection lead and counsel own the legal side.

• Then: Ask your certification body how it would audit the two together

Step

Continuity (ISO 22301): add impact analysis, plans and exercises

Add a business impact analysis, continuity strategies and plans for the activities in scope, and exercises with records. Much of this already exists if you have done the recovery and backup work: recovery time targets, dependencies and restore tests. Link them instead of rewriting them.

• Then: Ask your certification body how it would audit the two together

Step

Quality (ISO 9001): add customer requirements and quality objectives

Add customer requirements and how you check them, the processes that make the product or service, quality objectives and the handling of nonconforming output. The process approach in quality sits well with ISMS processes. Keep one objectives register with a column for each standard.

• Then: Ask your certification body how it would audit the two together

Step

Ask your certification body how it would audit the two together

Ask whether it offers a combined audit, whether it can reduce audit days for the shared clauses, whether the auditors are competent in both standards, and whether you get one certificate or two. Put the answers into the quote and compare bodies.

• Then: Does the body offer a combined audit?

Decision

Does the body offer a combined audit?

A combined audit samples the shared clauses once and the specific requirements for each standard. If the body does not, or you use a different body for each standard, plan for each to read the shared clauses on its own.

• Yes: Schedule combined audits and share the evidence room
• No, or not known: Keep the shared records consistent for separate audits

Step

Schedule combined audits and share the evidence room

Plan one visit with the shared clauses sampled once. Keep a single evidence room organised by clause, with the specific evidence for each standard marked. Agree which auditor leads.

• Then: Does one internal audit cover the shared clauses for every standard?

Step

Keep the shared records consistent for separate audits

Expect each body to read the policy, the management review and the internal audit. Make sure they say the same thing. A contradiction between two audits of one system is an easy finding.

• Then: Does one internal audit cover the shared clauses for every standard?

Decision

Does one internal audit cover the shared clauses for every standard?

The internal audit should sample the shared routines once and the specific requirements of each standard. If two audits examine the same routine separately, you are doing the same work twice.

• Yes: One system serving several standards, with the extra work identified
• No, or not known: Merge the duplicate audits and records into one routine and re-check

Step

Merge the duplicate audits and records into one routine and re-check

Merge the audit programmes, retire duplicate logs and agree one owner for each shared routine. Then audit once across both standards and check again.

• Then: Does one internal audit cover the shared clauses for every standard? (back to an earlier step)

Outcome

One system serving several standards, with the extra work identified

Keep the clause map, the scope statements, the combined audit plan and the body's answers. Do not say the second certificate is covered by the first, or that sharing routines means sharing certificates. Each certificate is issued on its own audit.