The organisation first recognises its starting state: informal arrangements covering both disciplines that were never formalised or integrated; one management system based on either standard; or two separate systems that are not integrated. Whatever the state, planning an integrated system should take into account at least: other management systems already in use, such as a quality system; the proposed scopes of the ISMS and SMS and any difference between them; all services and processes and how they depend on each other; which elements can be integrated and how; which elements stay separate; how customers, suppliers and the other interested parties are affected; the effect on technology in use; the effect on, or risk to, services and service management; the effect on information security and its management, or the risk to them; education and training in the integrated system; who is accountable and responsible for every requirement; and the stages and order of implementation work.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.