Every organisation already has some management system in its processes, plans and policies, and that should be adapted to conform to one or both standards rather than assumed absent. The order of implementing the ISMS and SMS requirements should follow business needs and priorities and the primary driver, such as competitive position or a customer's demand for conformity. The organisation decides whether to implement concurrently or sequentially; sequential work extends the first system with the second's requirements, concurrent work needs coordinated effort to avoid duplication. The scenarios offered: a service provider starts with ISO/IEC 20000-1 and expands into ISO/IEC 27001; an organisation relying on other parties for services starts with ISO/IEC 20000-1 for its richer supplier requirements; a small organisation focuses on one standard according to its reliance; concurrent implementation can be one project or two parallel sub-projects plus a third on integration; an organisation that puts information security first starts with ISO/IEC 27001. A working group meeting regularly during both implementations helps alignment and cuts duplicated effort.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.